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Abstract. We extend the usual internal logic of a (pre)topos to a more gen- 
eral interpretation, called the stack semantics, which allows for "unbounded" 
quantifiers ranging over the class of objects of the topos. Using well-founded 
relations inside the stack semantics, we can then recover a membership-based 
(or "material") set theory from an arbitrary topos, including even set-theoretic 
axiom schemas such as collection and separation which involve unbounded 
quantifiers. This construction reproduces the models of Fourman-Hayashi and 
of algebraic set theory, when the latter apply. It turns out that the axioms 
of collection and replacement are always valid in the stack semantics of any 
topos, while the axiom of separation expressed in the stack semantics gives 
a new topos-theoretic axiom schema with the full strength of ZF. We call a 
topos satisfying this schema autological. 
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1. Introduction 

It is well-known that elementary topos theory is roughly equivalent to a weak 
form of set theory. The most common statement is that the theory of well-pointed 
topoi with natural numbers objects and satisfying the axiom of choice (a.k.a. ETCS; 
see [Law64| ) is equiconsistent with "bounded Zermelo" set theory (BZC). This is 
originally due to Cole |Col73| and Mitcheh |Mit72| : see also Osius |Osi74) . Moreover, 
the proof is very direct: the category of sets in any model of BZC is a model of 
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ETCS, while from any model of ETCS one can construct a model of BZC out of 
well-founded relations. (The same ideas apply to stronger and weaker theories, but 
for clarity, in the introduction we will speak mostly about topoi.) 

In fact, Lawvere and others have observed that ETCS can itself serve as a foun- 
dation for much mathematics, replacing traditional membership-based set theoretic 
foundations such as BZC or ZFC. Although the term "set theory" often refers specif- 
ically to membership-based theories, it is clear that ETCS is also a set theory, in 
the inclusive sense of "a theory about sets." Pursuant to this philosophy, we will 
therefore use the term material set theory for theories such as BZC and ZFC which 
are based on a global membership predicate, and structural set theory for theories 
such as ETCS which take functions as more fundamental. (Some explanation of 
this terminology can be found in the appendix.) 

Whatever names we use for them, the relationship between these two types of 
theory is like other bridges between fields of mathematics, in that it augments the 
toolkit of each side by the ideas and techniques of the other. Of central impor- 
tance to such a programme is that under this equivalence, certain constructions in 
material set theory, such as forcing, can be identified with certain constructions in 
topos theory, such as categories of sheaves. However, there are surprising difficul- 
ties in making this precise, regarding the issue of well-pointedness^ It is only a 
well-pointed topos which can be regarded as a structural set theory and to which 
the Cole-Mitchell-Osius theory can be applied directly, since only in a well-pointed 
topos is an object, like a set, "determined by its elements" 1 X. But the cat- 
egorical constructions in question almost never preserve well-pointedness, so some 
trick is necessary to make the correspondence work. 

Of course, the trick is well-known in essence: any topos has an "internal logic" 
(often called the Mitchell- Benabou language) which appears much more set-theoretic. 
In the internal logic, we can speak about "elements" of objects, and the semantics 
automatically interprets statements about these elements into more appropriate 
categorical terms. For instance, a morphism / : X — y in an arbitrary topos is an 
epimorphism if and only if the statement "for all y £ Y, there exists an x G X with 
/(x) = y" is true in the internal logic. 

This trick is quite powerful, and in fact it is fundamental to the whole field of 
categorical logic. However, the internal logic of a topos is not a set theory of any 
sort (material or structural), but rather a "higher-order type theory." In particu- 
lar, it does not include unbounded quantifiers, i.e. quantifiers ranging over all sets. 
This is problematic for the programme of bridging between material and structural 
set theories, since many of the most interesting axioms of set theory (especially 
separation, collection, and replacement) involve such unbounded quantifiers. 

There do exist secondary tricks which have been used to get around this difficulty. 
The first was proposed by Fourman |Fou80j : if S is a complete topos (such as a 
Grothendieck topos), then we can mimic the construction of the von Neumann 
hierarchy inside S. We define inductively an object Va for each (external) ordinal 
a, setting Vq — 0, Va+i = PVa, and taking colimits at limit stages (hence the 
need for S to be complete). Now the internal logic can speak about "elements" 
of the objects Va, which inherit a "membership" structure from their construction 
and can be shown to model material set theories. Hayashi |Hay81| independently 
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proposed a more general approach in which the Va can be replaced by any class of 
objects satisfying suitable closure conditions. 

While this construction works quite well, we find it somewhat unsatisfying for 
several reasons. Firstly, it appears to depend on the non-elementary hypothesis 
of completeness, which is not preserved by some constructions on toposes (such as 
realizability and filterquotients) . Secondly, it appears to depend on power objects, 
which would make it inapplicable to compare pretoposes with "predicative" material 
set theories. Finally, the treatment of unbounded quantifiers is asymmetrical — they 
appear in the material set theory as if by magic, but there is no natural, category- 
theoretic, treatment of unbounded quantifiers on the topos side. 

A more recent solution, begun by Joyal and Moerdijk in [JM95] . is to consider not 
just a topos, but a category of classes in which it sits as the "small objects." This 
is a category-theoretic version of material class-set theories such as Bernays-Godel 
or Morse-Kelley. A category of classes contains a single object V, "the class of all 
sets," which admits a membership relation which satisfies the axioms of material set 
theory in the internal logic of the category of classes. This approach, called algebraic 
set theory, avoids some of the problems with the Fourman-Hayashi approach. It 
is purely elementary at the level of the category of classes, and applies as well in 
the absence of powersets. And the internal logic of the category of classes provides 
a compelling category-theoretic treatment of "unbounded" quantifiers — they are 
simply bounded quantifiers over the class of all sets. 

However, algebraic set theory also has its own disadvantages, foremost among 
which is the fact that instead of studying a topos by itself, one must now always 
somehow construct, and always carry along, a category of classes containing it. 
One would ideally wish for a canonical embedding of any topos into a category of 
classes, under which all desirable topos-theoretic structure corresponds equivalently 
to suitable structure on the category of classes. It is shown in [AF061 fAFW06l that 
every small topos can be embedded in some category of classes, via a construction 
which is in some ways canonical. However, the resulting category of classes will 
not, in general, satisfy axioms such as separation, even for toposes which might be 
expected to validate them (for instance, those which validate their material counter- 
parts under the Fourman-Hayashi interpretation). A different construction is given 
by [ABSSOTal lABSSOTb] , which does in some cases produce categories of classes 
satisfying separation, but it is very non-category-theoretic in fiavor (in the sense 
that it distinguishes between isomorphic objects) and certainly less canonical. 

A second problem with algebraic set theory is that one has to worry about 
whether any given categorical construction can be extended from elementary toposes 
(where the results are usually known and easy) to any categories of classes that may 
contain them. In general, this turns out to be true, but the proofs often require a 
great deal of work (see, for instance, AGJMM, vdBM07 . vdBM08, vdBMOQ). 

I do not mean to denigrate the great advances in understanding produced by 
algebraic set theory, and the Fourman-Hayashi interpretation has also been very 
fruitful. The relationship between the two is also known: the "ideal semantics" 
of [ABSS07a| lABSSOTb) generalizes the forcing semantics of Hayashi. However, 
it would undoubtedly also be useful to have a unified, canonical, elementary, and 
category-theoretic treatment of unbounded quantifiers over an arbitrary (pre)topos. 
The interpretations of Fourman-Hayashi and algebraic set theory would then, ide- 
ally, turn out to be special cases or generalizations of this unified framework. 



4 



MICHAEL A. SHULMAN 



The thesis of this paper is that such a thing is indeed possible; it is what we caU 
the stack semantics. We can motivate this semantics in two ways. The first is to 
observe that higher-order type theory (that is, the internal logic of a topos) looks 
very much like a fragment of structural set theory (i.e. the theory of well-pointed 
topoi). Types correspond to objects of the category, and each term x of type A 
corresponds to a morphism 1 — >■ A. In this way any assertion in type theory can 
be translated into an assertion in the first-order theory of well-pointed categories. 
However, the latter theory also includes quantifiers over objects of the category, so 
it is natural to seek a generalization of the internal logic which models the first- 
order theory of well-pointed categories, rather than higher-order type theory^ The 
stack semantics is exactly such a generalization. 

(When the logic is intuitionistic, as it is in the stack semantics, the notion of 
"well-pointed" has to be modified a bit; see fJS] For clarity, we usually refer to 
this modified property constructive well-pointedness; thus what the stack semantics 
really models is the first-order theory of constructively well-pointed topoi.) 

From this point of view, the stack semantics can be defined directly by generaliz- 
ing the "Kripke-Joyal" description of the internal logic via a forcing relation. This 
description is thus closely related to Hayashi's forcing interpretation of material set 
theory, and also to the forcing semantics defined in [ABSSOJb, ABSSOTaj . 

A second motivation for the stack semantics comes from trying to make the 
logic of a category of classes more canonical and category-theoretic. Specifically, 
if S is a small topos, an obvious "canonical" candidate for a category of classes 
containing it is the category Sh(S) of sheaves for the coherent topology on S. (The 
category of ideals defined in |AF06[ IAFW0 6^ is a certain well-behaved subcategory 
of Sh(S).) If we then want to interpret "unbounded" quantifiers over objects of S 
as "bounded" quantifiers in the internal logic of Sh(S), we need a suitable object 
to serve as "the class of sets." Or, more category-theoretically, we want an internal 
category in Sh(S) to serve as "the category of sets," and ideally we would like this 
internal category to also be canonically determined by S. 

Now S of course has a canonical representation as a stack over itself, namely 
the "self- indexing" or "fundamental fibration" X i-t- S/X. This is not an internal 
category in Sh(S), since it is not a strict functor, only a pseudofunctor. But we can 
choose some strictification of it, which is therefore an internal category in Sh(S), 
and let our "unbounded" quantifiers run over this. This is precisely the approach 
taken in |Awo971 Ch. V], where it was additionally observed that in the internal 
logic of Sh(S), the self-indexing is (in our terminology) constructively well-pointed. 
However, now we take the additional step of isolating the particular fragment of 
the internal logic of Sh(S) whose only "unbounded" quantifiers range over the self- 
indexing. Modulo one small caveat, this fragment is canonically determined by the 
topos S, and when expressed in the sheaf semantics of Sh(S) via a forcing relation 
over the site S, it agrees with the stack semantics defined using the first approach. 

The caveat is that there is one other thing this logic depends on: the chosen 
strictification of the self-indexing. However, this choice only affects the truth values 
of "non-category-theoretic" formulas, such as those which assert equalities between 
objects. In the stack semantics proper, we exclude such formulas by restricting to 
a dependently typed logic in which there simply is no equality predicate between 
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objects. (This is also precisely the necessary restriction so that the truth of such 
formulas be invariant under equivalence of categories.) This restricted logic can 
then be naturally identified with a fragment of the internal logic of the 2- category 
St{S) of stacks on S. (The internal logic of a 2-category is not well-known, but it 
can be defined by close analogy with that of a 1-category; see |Shud| .) 

The existence of these multiple approaches to the stack semantics contributes to 
the feeling that it is a natural part of topos theory, though heretofore seemingly 
unappreciated. In fact, however, it is implicitly present throughout the literature. 
Topos theory abounds with definitions, arguments, and theorems that are said to be 
"internal" statements, but in many cases this cannot be directly understood as an 
assertion in the usual internal logic due to the presence of unbounded quantifiers. As 
a very simple example, the external topos-theoretic "axiom of choice" (AC) asserts 
that every epimorphism splits. This involves an unbounded quantification over all 
objects of the topos, so it is not directly internalizable. Instead, the "internal axiom 
of choice" (lAC) asserts (in one formulation) that for any object A, the functor 
Ha ■ S/A — !> S preserves epimorphisms. To a beginner, it may not be obvious why 
this is the "internalization" of AC. But it turns out that I AC is equivalent to the 
validity in the stack semantics of the statement "every epimorphism splits." 

The proper way of internalization of such statements does soon become second 
nature to experts, and it has even started to appear more openly in the literature, 
such as in the "informal arguments" given in jMP02| . However, to my knowledge 
it has never before been given a formal, precise expression. This is what the stack 
semantics provides: a formal definition of the language whose statements we can ex- 
pect to internalize, along with a procedure for performing that internalization and a 
theorem that the resulting semantics is sound. Thus, it has the potential to simplify 
and clarify many arguments in topos theory, by reducing them to internalizations 
of easier proofs in structural set theory. 

(This effect is even more pronounced when the stack semantics is generalized to 
the full internal logic of iSi(S). In [Shuc] we will show that almost any argument in 
the "naive" theory of large categories, such as Freyd's adjoint functor theorem, or 
Giraud's theorem characterizing Grothendieck topoi, can be interpreted in the gen- 
eralized stack semantics to immediately yield the corresponding result for indexed 
categories over any base topos.) 

However, in the present paper we are only concerned with the basic theory of 
the stack semantics, and its application to comparison of material and structural 
set theories. In particular, by generalizing the higher-order type theory of the in- 
ternal logic to a semantics for structural set theory, the stack semantics enables 
us to reconstruct an interpretation of material set theory from any topos, by sim- 
ply performing a version of the Cole-Mitchell-Osius construction inside the stack 
semantics. As suggested previously, this unifies, rather than replaces, the exist- 
ing approaches of Fourman-Hayashi and of algebraic set theory. On the one hand, 
if the topos is complete, then the Fourman-Hayashi model can be identified with 
that derived from the stack semantics (in fact, one version of Hayashi's approach 
essentially is the stack semantics model). On the other hand, if a topos S is em- 
bedded inside a category of classes C (and S "generates" C in a suitable sense), 
then the stack semantics of S agrees with a fragment of the internal logic of C (as 
summarized above in the case C — Sh(S)), and in good cases the resulting models 
of material set theory can also be identified. 
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In a sense, these equivalences are really only an expected "consistency check." 
We believe that where the stack semantics really shows its worth is in suggesting 
topos-theoretic counterparts of additional set-theoretic axioms such as separation, 
collection, and replacement, which until now have been largely absent from the 
literature. With a little thought, it is not hard to write down axioms for struc- 
tural set theory which correspond under the Cole-Mitchell-Osius equivalence to the 
material-set-theoretic axioms of separation, collection, and replacement. By then 
interpreting these axioms in the stack semantics, we can obtain true topos-theoretic 
versions of such axioms which are applicable to an arbitrary topos. 

It turns out that under interpretation in the stack semantics, the axioms of 
collection and of separation behave quite differently. The axiom of collection (and 
hence that of replacement) is always valid in the stack semantics of any topos. (The 
fact that forcing semantics always validate collection has been observed elsewhere, 
e.g. |ABSS07a) .) It follows that the models of material set theory constructed from 
the stack semantics always validate the material version of collection, providing a 
neat proof of the well-known fact that intuitionistically, collection without separa- 
tion adds no proof-theoretic strength. In fact, collection emerges as precisely the 
dividing line separating the "internal" stack semantics from the "external" logic: 
a constructively well-pointed topos satisfies collection (in the "external" sense, not 
in its stack semantics) if and only if validity in its stack semantics is equivalent to 
"external" truth for all sentences. 

On the other hand, the stack-semantics version of separation seems to be a new 
topos-theoretic property. We call a topos with this property autological. AutologjH 
is also closely connected to the stack semantics: a topos is autological if and only if 
its stack semantics is representable, in the same sense that the usual Kripke-Joyal 
semantics is always representable. (This motivates the name: a topos is autological 
if the logic of its stack semantics can be completely "internalized" by representing 
subobjects.) Autology is also quite common and well-behaved; for instance, we will 
show in that all complete topoi are autological, and in in |Shubj we will study 
its preservation by other topos-theoretic constructions (including realizability). 

Moreover, since autology is simply the axiom of separation in the stack semantics, 
the Cole-Mitchell-Osius model of material set theory constructed from an auto- 
logical topos must validate both collection and separation. Thus, autology provides 
a natural and fully topos-theoretic strengthening of the notion of elementary topos, 
which is equiconsistent with full ZF set theory, and which "explains" why complete 
and realizability topoi are known to model (intuitionistic) ZF. These two cases have 
been addressed by algebraic set theory in ABSSOTa l IABSS07b| . but as remarked 
above, the construction there is non-category-theoretic and non-elementary. 

In fact, the relationship of autology to the axiom of separation for categories of 
classes is unidirectional: if a category of classes satisfies separation, then its topos 
of small objects is autological, but not conversely. The issue is that since autology 
is a first-order axiom schema, it can only speak about proper classes which are 
definable in some sense over the topos, but the objects of a category of classes need 
not be definable in any such way. 

One might, however, ask whether every autological topos could be embedded in 
some category of classes satisfying separation, analogously to to how every model 
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of ZFC can be embedded in some model of Bernays-Godel class-set theory (namely, 
the model consistmg of its definable proper classes). We will show in |Shuaj that 
the answer is almost yes: any autological topos can be embedded in a 2-category 
of "definable stacks" which satisfies separation, and which satisfies 2-categorical 
versions of the axioms of algebraic set theory. However, it seems unlikely that 
this can be improved to a 1-category of classes, since this would require some 
sort of definable rigidification of the self-indexing. This suggests that perhaps we 
should study 2-categories of large categories instead of categories of classes. Such 
a modification is also category-theoretically natural, since in practice we generally 
only care about elements of a proper class insofar as they form some large category. 
See [Shuai IShucj for further exploration of this idea. 

The plan of the paper is as follows. We begin by defining carefully the material 
and structural set theories we plan to compare. Since material set theories are 
quite familiar, we list their axioms briefly in [21 while in §Sj3Hn] we spend rather 
more time on the axioms of structural set theory. In both cases we include "pred- 
icative" theories as well as "impredicative" ones. Then in ^we describe a version 
of the Cole-Mitchell-Osius comparison that is valid even predicatively, since the 
construction does not appear to be in the literature in this generality. 

The core of the paper is fJTJ in which we introduce the stack semantics and 
prove its basic properties, including the interpretations of the axioms of separation 
and collection mentioned above. It is then almost trivial to derive the desired 
interpretations of material set theory; we say a few words about this in |j8l Then in 
§i}9land[T0lwc show that this interpretation agrees with both the Fourman-Hayashi 
model and with the models of algebraic set theory. Appendix [Al is devoted to some 
philosophical remarks comparing material and structural set theory, particularly as 
foundations for mathematics. 

Our basic reference for topos-theoretic notions is j Joh02| . One important thing 
to note is that we will use intuitionistic logic in all contexts. This is in contrast 
to the common practice in topos theory of reasoning about the topos itself using 
classical logic, though the internal logic of the topos is intuitionistic. Our approach 
is necessary because we want all of our arguments to remain valid in the stack 
semantics, which, like the internal logic of a topos, is generally intuitionistic. We 
treat classical logic as an axiom schema (namely, ip V ^ip for all formulas ip) which 
may or may not be satisfied by any given model. 

All of our theories, material and structural, are of course properly expressed in 
a formal first-order language. However, to make the paper easier to read, we will 
usually write out logical formulas in English, trusting the reader to translate them 
into formal symbols as necessary. To make it clear when our mathematical English 
is to be interpreted as code for a logical formula, we will often use sans serif font 
and corner quotes. Thus, for example, in a structural set theory, '"every surjection 
has a section^ represents the axiom of choice. 

If M models some theory, by a formula in M we mean the result of substituting 
elements of M for some of the free variables of a formula in a well-typed way. The 
substituted elements of M are called parameters. If parameters are substituted 
for all the free variables of ip (including the case when tp had no free variables), we 
say (fi is a sentence in M. There is an obvious notion of when a sentence (/? in M 
is true, which we denote 'M.\= ip (read M satisfies ip). Recall that our metatheory, 
in which we formulate this notion of truth, is intuitionistic. 
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Many of the axioms wc state will be axiom schcmas depending on some formula 
Lp. In each such case, may have arbitrary additional unmentioned parameters. 
Equivalently, such axiom schemas can be regarded as implicitly universally quanti- 
fied over all the unmentioned variables of 

I would like to thank Steve Awodey, Toby Bartels, Peter Lumsdaine, Colin 
McLarty, Thomas Streicher, Paul Taylor, and the patrons of the n-Category Cafe 
for many helpful conversations and useful comments on early drafts of this paper. 

2. Material set theories 

Our material set theories will be theories in one-sorted first order logic, with a 
single binary relation symbol G, whose variables are called sets. (We will briefly 
mention the possibility of "atoms" which arc not sets at the end of this section.) 
In such a theory, a IS.Q- quantifier is one of the form (3a; G a) or (Vx G a), and a 
Ao-formula (also called restricted or bounded) is one with only Ao-quantifiers. The 
prefix "Aq-" on any axiom schema indicates that the formulas appearing in it are 
restricted to be Aq; we sometimes use the adjective "full" to indicate the lack of 
any such restriction. 

Definitions 2.1. 

• We write { x \ (p{x) } for a set a such that x E a ^ if such a set exists. 

• A relation from a to 6 is a set r of ordered pairs {x, y) such that x G a and 
y eb, where {x, y) = {{x}, {x, y}}. 

• A relation r from a to 5 is entire (or a many-valued Junction) if for all x G a 
there exists y & b with [x, y) G r. If each such y is unique, r is a function. 

• A relation r is bi-entire if both r and r° = { {y, x) \ {x,y) G r } are entire. 

The following set of axioms (in intuitionistic logic) we call the core axioms; 
they form a subsystem of basically all material set theories. 

• Extensionality: '~for any x and y, x = y \f and only if for all z, z G x \if z € y~'. 

• Empty set: '~the set = {} exists''. 

• Pairing: '"for any x and y, the set {x,y} exists"'. 

• Union: '"for any x, the set { z | (3^ € x){z € y) } exists"'. 

• Ao-Separation: For any Ag-formula ip{x), '"for any a, { a; G a | Lp{x) } exists"'. 

• Limited Aq -replacement: For any Ag-formula </?(a:, y), '"for all a and b, if for every 
a; G a there exists a unique y with ip{x,y), and moreover 2; C 6 for all z £ y, then 
the set { y I (3a; G a)ip{x, y) } exists"'. 

The first five of these are standard, while the last, though very weak, is unusual. 
Wc include it because we want our core axioms to imply a wcll-bchavcd category 
of sets, for which purpose the other five arc not quite enough. It is satisfied in 
basically all material set theories, since it is implied both by ordinary replacement 
(even Ao-replacement) , and by the existence of power sets (using Ao-separation). 

We now list some additional axioms of material set theory, pointing out the 
most important implications between them. Of course, there are many possible 
set-theoretic axioms; we will consider only the most common and important ones. 

One major axis along which set theories vary is "impredicativity," expressed by 
the following sequence of axioms (of increasing strength): 

• Exponentiation: '"for any a and b, the set fe" of all functions from a to & exists^. 

• Fullness: '"for any a, b there exists a set m of entire relations from a to 6 such that 
for any entire relation / from a to b, there is a g G m with g C f. 
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• Power set: ^for any set x, the set Px = { y | y C x } exists"'. 

Each of these is strictly stronger than the preceding one, but in the presence of 
either of the following: 

• Aa-classical logic: for any Ao-formula if, we have if V -i<p. 

• Full classical logic: for any formula tp, we have (p V -itp. 

the hierarchy of predicativity collapses, since power sets can then be obtained (using 
limited Ap-replacement) from sets of functions into a 2-element set. Hence classical 
logic is also impredicative. Also considered impredicative is: 

• (Full) Separation: For any formula (p{x), '"for any a, { x G a \ (p{x) } exists"'. 

Full separation and Ao-classical logic together imply full classical logic, since we can 
form a = {0|(p}C{0}, and then (0 G a) V (0 ^ a) is an instance of Ag-classical 
logic that implies Lp\J ^Lp. 

We also have the collection and replacement axioms. 

• Collection: for any formula ip{x,y), '"for any a, if for all a; e a there is a y with 
(p{x,y), then there is a 6 such that for all x ^ a, there is a y G & with (p{x,y), and 
for all y E b, there is a a; G a with ip{x,y)~'. 

• Replacement: for any formula ip{x,y), ^for any a, if for every x <E a there exists a 
unique y with ip{x,y), then the set { ?/ | {3x G a)ip{x,y) } exists"'. 

With an evident extension of 12.1! to formulas, we can state collection as "if is 
entire on a, then there exists b such that (p is bi-entire from a to 5." Collection 
also evidently implies replacement. Classical ZF set theory is usually defined using 
replacement rather than collection, but in the presence of the other axioms of 
ZF, collection can be proven. (Replacement and full classical logic together also 
imply full separation.) This is no longer true in intuitionistic logic, though, or in 
classical logic without the axiom of foundation, and in practice the extra strength 
of collection is sometimes important. There are also other versions of collection, 
all of which are equivalent in the presence of full separation, but the one we have 
chosen seems most appropriate in its absence. 

We state the axiom of infinity as the existence of the set ut of finite von Neumann 
ordinals. Together with the core axioms, this implies the Peano axioms for w, 
including induction for any property to which we can apply separation. For a 
stronger version of induction, we need a separate axiom. 

• Infinity: '"there exists a set uj such that G w, if a; G w then x U {x} G uj, and if z 
is any other set such that G z and if a; G 2: then x U {x} G z, then oj C z^. 

• Induction: for any formula tp, '"if (p(0) and ip{x) ip{x U {x}) for any x uj, 
then (p{x) for all x G oj^. 

There is also: 

• Choice: '"for any set a, if for all x G a there exists a y G then there exists a 
function / from ato[Ja such that f{x) G x for all x G a^. 

By Diaconescu's argument |Dia75| . choice and power set together imply Ao-classical 
logic. There are of course many variants of choice, such as countable, dependent, 
or "multiple" choice, or the "presentation axiom" (a.k.a. "EPSets" or "COSHEP," 
the Category Of Sets Has Enough Projectives), but we will confine our attention 
to the ordinary version. 

Finally, we have the family of "foundation-type" axioms. Recall that a set x is 
called transitive if z G y G a; implies z G a;. A set X with a binary relation -< is called 
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well-founded if whenever Y C X is inductive, in the sense that (Vy -< x)(y G Y) 
imphes x GY, then in fact Y ~ X. It is extensional if (Vz G < x ^ z ^ y) 

imphes x = y. 

• Set-induction: for any formula (/^(a;), '"if for any set y, (p{x) for all a; G y implies 
(p{y), then <p(x) for any set a;"'. 

• Foundation, a.k.a. Aa-Set-induction: hke set-induction, but only for Ao-formulas. 

• Transitive closures: ^every set is a subset of a smallest transitive set"'. 

• Mostowski's principle: ^every well-founded extensional relation is isomorphic to a 
transitive set equipped with the relation G"'. 

The usual "classical" formulation of foundation is 

• Regularity: '"if x is nonempty, there is some y G x such that x Ciy — 0"'. 

In the presence of transitive closures, regularity is equivalent to the conjunction of 
Ao-set-induction and Ap-classical logic. Thus, in an intuitionistic theory, Ap-set- 
induction is preferable. Of course, Ao-set-induction follows from full set-induction, 
while the converse is true if we have full separation. Set-induction also implies 
ordinary induction, since < and G are the same for von Neumann ordinals. 

Transitive closures can be constructed either from set-induction and replace- 
ment (see jAROlj l. or from infinity, ordinary (full) induction, and replacement. 
Mostowski's original proof shows that his principle follows from replacement and 
full separation. Transitive closures and Mostowski's principle are not usually con- 
sidered "foundation" axioms, but we group them thusly for several reasons: 

• The conjunction of transitive closures, Mostowski's principle, and foundation is 
equivalent to the single statement "to give a set is the same as to give a well- 
founded extensional relation with a specified element." One could argue that 
this sums up the objects of study of well-founded material set theory. 

• As we will see in [JH it follows that the material set theories that can be con- 
structed from structural ones are precisely those which satisfy these three axioms. 

• Finally, the various axioms of anti-foundation are also naturally stated as "to 
give a set is the same as to give a (blank) relation with a specified element," 
where (blank) denotes some stronger type of extensionality (there are several 
choices; see |Acz88| ) . Thus, these axioms naturally include analogues not just 
of foundation, but also of transitive closures and Mostowski's principle. 

Some particular material set theories with names include the following. Note that 
the prefix constructive is generally reserved for "predicative" theories (including, 
potentially, exponentiation and fullness, but never power sets or full separation) 
while intuitionistic refers to "impredicative" (but still non-classical) theories which 
may have power sets or full separation. None of these theories include our axiom 
of limited Ap-replacement explicitly, but all include either power sets or a stronger 
version of replacement, both of which imply it. 

• The standard Zermelo-Praenkel set theory w^ith Choice (ZFC) includes 
all the axioms mentioned above, although it suffices to assume the core axioms 
together with full classical logic, power sets, replacement, infinity, foundation, 
and choice. 

• By Zermelo set theory (Z) one usually means the core axioms together with 
full classical logic, power sets, full separation, and infinity. 
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• The theory ZBQC of |ML86| . called RZC in |MLM94| VI. 10], consists of the 
core axioms together with full classical logic, power sets, infinity, choice, and 
regularity. 

• The Mostowski set theory (MOST) of [MatOlj consists of ZBQC together 
with transitive closures and Mostowski's principle. 

• By Kripke-Platek set theory (KP) is usually meant the core axioms together 
with full classical logic, a form of Ao-coUection (sufficient to imply our limited 
Ao-replacement), and set- induction for some class of formulas. 

• Aczel's Constructive Zermelo-Praenkel (CZF) consists of the core axioms 
together with fullness, collection, infinity, and set-induction; see [AROlj . His 
CZFq consists of the core axioms, replacement, infinity, and induction. 

• The usual meaning of Intuitionistic Zermelo-Praenkel (IZF) is the core 
axioms together with power sets, full separation, collection, infinity, and set- 
induction. This is the strongest theory that can be built from the above axioms 
without any form of classical logic or choice. 

• The Basic Constructive Set Theory (BCST) of [AFW06) consists essen- 
tially of the core axioms together with replacement. Their Constructive Set 
Theory (CST) adds exponentials to this, and their Basic Intuitionistic Set 
Theory (BIST) adds power sets. (These theories also allow atoms; see below.) 

• The Rudimentary Set Theory (RST) of |vdBM07j consists of the core ax- 
ioms together with collection and set-induction. 

So far we have considered only theories of pure sets, i.e. in which everything is 
a set. If we want to also allow "atoms" or "urelements" which are not sets, we can 
modify any of the above theories by adding a predicate '~x is a set"', whose negation 
is read as '~x is an atom^. We then add the following axioms: 

• Decidability of sethood: '"every x is either a set or an atom"'. 

• Only sets have elements: '"if x E y, then y is a set^. 

• Set of atoms: ^the set { a; | x is an atom } exists"'. 

and modify the extensionality axiom so that it applies only to sets: 

• Extensionality for sets: '"for any sets x and y, x = y \i and only if for all z, z G x 
iff z G y"'. 

3. Structural set theory: well-pointed Heyting pretoposes 

We now move on to structural set theories. Here we must be a little more careful 
with the ambient logic. The theory of categories can, of course, be formulated in 
ordinary first-order logic, but this is unsatisfactory because it allows us to discuss 
equality of objects. We need all our formulas to express "category-theoretic" facts, 
and thus we must avoid ever asserting that two objects are equal (rather than 
isomorphic). However, we cannot simply remove the equality predicate on objects 
from the ordinary first-order theory, because there are situations in which we do 
need to know that two objects are the same. For example, to compose two arrows 
/ and g, we need to know that the source of g is the same as the target of /. 

The solution to this problem, which has seemingly been rediscovered many times 
(see, for instance, |Bla791 lFre761 IMak951 IMak'OT] ') is to use a language of dependent 
types. We give here a somewhat informal description in an attempt to avoid the 
complicated precise syntax of dependent type theory, but the reader familiar with 
DTT should easily be able to expand our description into a formal one. 
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Definition 3.1. The language of categories (with terminal object) consists of 
the following. 

(i) There is a type of objects. 

(h) There is a specified object-term 1. 

(iii) For object-terms X and Y, there is a type X — > F of arrows from X to Y. 

(iv) For each object-term X, there is an arrow-term Ix ■ X X . 

(v) For any object-terms X, Y, and Z and each pair of arrow-terms f : X ^ Y 
and g: Y ^ Z, there is an arrow-term {g o f): X ^ Z. 

(vi) For any arrow-terms f,g: X --^Y, there is an atomic formula {f ~ g)- 

Non-atomic formulas are built up from atomic ones in the usual way, using connec- 
tives T, _L, A, V, =>, -1, and quantifiers 3 and V. There are of course two types of 
quantifiers, for object- variables and for arrow- variables. Any category is a structure 
for this language, and we have the usual satisfaction relation K\= Lp for a category 
A and a sentence (/9 in A. 

Of course, this theory uses very little of the full machinery of DTT, and in 
particular it may be said to live in the "first-order" fragment of DTT. In this way 
it is closely related to the logic FOLDS studied in |Mak95] . although we are allowing 
some term constructors in addition to relations. 

Our inclusion of a specified term 1, intended to denote a terminal object, is just 
for convenience; it will make it easier to single out the Ao-formulas. The other main 
thing to note is that, as in FOLDS, the only atomic formulas are equalities between 
parallel arrows; the language does not allow us to even discuss whether two objects 
are equal. This implies that "truth is isomorphism- and equivalence-invariant," in 
a sense we can make precise as follows. 

Let A be a category, let (/? be a sentence in A, and suppose we are given, for 
each object-parameter A in (p, an isomorphism A ^ A' in A. Let ip' denote the 
sentence in A obtained from (p by replacing each object-parameter A by A' and 

each arrow-parameter A — ^ B by the composite 

A' ^A^ B ^B'. 

We call ip' an isomorph of Likewise, if F: A — B is any functor and is a 
sentence in A, we write F{ip) for the sentence in B obtained by applying F to all 
the parameters of (p. The following can then easily be proven by induction on the 
construction of formulas. 

Lemma 3.2 (Isomorphism- invariance of truth). If ip is a sentence in A and ip' an 
isomorph of ip, then A\= ip if and only if A\= tp' . □ 

Lemma 3.3 (Equivalence invariance of truth). If F is fully faithful and essentially 
surjective, then ip if and only i/B N F(ip). □ 

In fact, the dependently typed theory of categories characterizes exactly those 
properties of categories which are invariant under equivalence in this sense; see [Bla79| 
lFre76, Mak95|. 

We now begin a listing of the axioms of the structural set theories we will con- 
sider. First of all, we must have a category, so we include: 

• Identity: lyo/ = / = /olx. 

• Associativity: h o [g o f) — (h o g) o f . 
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Many of the additional axioms of structural set theories assert well-known cate- 
gorical properties. Recall that a Heyting category is a category S satisfying the 
following axioms. 

• Finite limits: '~S has pullbacks, and 1 is a terminal object"'. 

• Regularity: '"every morphism factors as a regular epi followed by a monic, and 
regular epis are stable under pullback"'. 

• Coherency: ^finite unions of subobjects exist and are stable under pullback"'. 

• Dual images: '"for any f:X^Y, the pullback functor /* : Sub(F) — > Sub(X) 
has a right adjoint V/"'. 

Here Sub(X) denotes the poset of subobjects of X, i.e. of monomorphisms into X 
modulo isomorphism. If S also satisfies 

• Positivity/extensivity: '"S has disjoint and pullback-stable binary coproducts"'. 
it is called positive (or extensive). If it is positive and also satisfies: 

• Exactness: '"every equivalence relation is a kerneP. 

it is called a Heyting pretopos. A Heyting pretopos which also satisfies: 

• Local cartesian closure: '"for every arrow / : X ^Y, the pullback functor /* : S/Y — ^ 
S/X has a right adjoint H/"' 

(which implies dual images) is called a H-pretopos. Finally, if it satisfies: 

• Power objects: '"every object X has a power object PX~' 

(which, together with finite limits, implies all the other axioms of a H-pretopos) 
it is called an (elementary) topos. See, e.g., [Joh02[ §A.l] for more details. In 
particular, we remind the reader that in a pretopos, every monic and every epic is 
regular, and thus it is balanced (every monic epic is an isomorphism). Also, the self- 
indexing of any regular category is a prestack for its regular topology (generated by 
regular epimorphisms), and it is a stack if the category is exact (such as a pretopos). 

Remark 3.4. Axioms which assert the existence of adjoints (such as dual images and 
local cartesian closure) seemingly go beyond first-order logic, but they can easily 
be formulated in an elementary way, as simply asserting the existence of objects 
with a suitable universal property. 

Three other important axioms are the following: 

• Booleanness: '"every subobject has a complement^. 

• Full classical logic: for any formula if, we have if V 

• Infinity: '"there exists a natural number object (nno)"'. 

• Choice: '"every regular epimorphism splits"'. 

(If S is not cartesian closed, then the definition of an nno should be taken with 
arbitrary parameters; see [Joh02[ A2.5.3].) 

Each of the above axioms (beyond those of a Heyting pretopos) is, more or 
less obviously, a counterpart of some axiom of material set theory. The first easy 
observation is that each material axiom implies its corresponding structural axiom 
for the category of sets. 

Theorem 3.5. //V satisfies the core axioms of material set theory, then the sets 
and functions in V form a Heyting pretopos Set(V). Moreover: 
(i) IfV satisfies exponentiation, then Selt(V) is locally cartesian closed. 

(a) IfV satisfies the power set axiom, then Selt(V) is a topos. 

(Hi) IfV satisfies classical logic, then Se[t(V) is Boolean. 
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(iv) If\ satisfies full classical logic, so does Se[t(V). 
(v) IfV satisfies infinity and exponentials, then Se[t(V) has a NNO. 
(vi) //V satisfies the axiom of choice, then so does Selt(V). 

Proof Wc first show that Se[!;(V) is a category. Using pairing and limited Aq- 
replacement, we can form, for any set a and any x € a, the set Pa,x of all pairs 
{a;, y} for y & a. Again using limited Ao-replacement, we can form the set of all 
the pa^x for X € a, and take its union, thereby obtaining the set of all pairs {x, y} 
for x,y € a. Applying this construction twice to a U 6 = U{^)^}) "we can then 
use Ao-separation to cut out the set a x 6 of ordered pairs {x, y) where x £ a and 
y E b. With this in hand we can define function composition and identities using 
Ao-separation. 

Finite limits are straightforward: we already have products, {0} is a terminal 

object, and Ao-separation supplies equalizers. The construction of pullback-stable 
images, unions, and dual images is also easy from Ao-separation. A stable and 
disjoint coproduct a + b can as usual be obtained as a subset of {0, 1} x (a U b). 
And if r C a X a is an equivalence relation, Ao-separation supplies the equivalence 
class of any x € a, and limited Ao-replacement then supplies the set of all such 
equivalence classes. 

Exponentiation clearly implies cartesian closedness. For local cartesian closed- 
ness, suppose given / : a — )■ 6 and g: x ^ a. Then the fiber of 11/(5) ~^ ^ over 
j G b should be the set of all functions s: f~^{j) — > x such that g o s = l/-i(j); 
this can be cut out of x^ by Ao-scparation. Finally, the entire set Ilf{g) can 
be constructed from these and limited Ao-replacement, since each element of each 
fiber is a subset of a x x. 

The relationship between power sets and power objects is analogous. Likewise, 
Ao-classical logic is equivalent to saying that every subset has a complement, which 
certainly implies Booleanness of Selt(V). The implication for full classical logic is 
also evident. 

Now suppose that V satisfies infinity and exponentials, and let w be as in the 
axiom of infinity; we define e w and s: w — )• w in the obvious way. Suppose 
given A B <— B; we must construct a unique function f : A x lo — >■ B such 
that f{lA x 0) = giTi and /(l^ x s) = tf. Let R = { {a,b) G u> x w \ a e b } with 
projection 7r2 : i? — > w, and let X be the exponential (B x w — >■ u})(^^^-^'^) in 
Set/w; thus an element of X is equivalent to an n G w together with a function 
f: Ax{m\mGn} — >■ B. Using Ao-separation, we have the subset Y C X 
of those f € X such that /(a, 0) = g{a) and /(a, .s(m)) = t{f{a,m)) whenever 
s(to) G n. We then prove by induction that for all n E uj there exists an f G Y 
with n G dom(/) and that for any two such /, /' we have /(n) = f'{n). The union 
of Y is then the desired function. 

Finally, if V satisfies choice, then from any surjection p: e — >■ 6 wc can construct, 
using limited Ao-replacement, the set { p~^{x) \ x Gb}, and applying the material 
axiom of choice to this gives a section of p. □ 

However, not every Heyting pretopos deserves to be called a model of structural 
set theory. The distinguishing characteristic of a set, as opposed to an object of 
some more general category, is that a set is dcitermined by its elements and nothing 
more. This is expressed by the following property. 
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Definition 3.6. A Heyting category S is constructively well-pointed if it sat- 
isfies tlie following. 

(a) li m: A ^ X is monic and every 1 X factors through m, then m is an 
isomorphism (1 is a strong generator). 

(b) Every regular epimorphism X ^ 1 splits (1 is projective). 

(c) If 1 is expressed as the union of two subobjects 1 ~ AU B, then either A or B 
must be isomorphic to 1 (1 is indecomposable). 

(d) There does not exist a map I (1 is nonempty). 

Remark 3.7. Of course, since regular epis are stable under puUback, 1 is projective 

p 

if and only if for any regular epi Y — » X, every global element 1 X lifts to Y. 
Likewise, since unions are stable under puUback, 1 is indecomposable if and only if 
whenever X = AUB, every global element 1 — )■ X factors through either Aor B. In 
particular, if S is locally small in some external set theory, then S is constructively 
well-pointed if and only if S(l, — ) : S — > Set is a conservative coherent functor. 

We immediately record the following. 

Proposition 3.8. //V satisfies the core axioms of material set theory, then S(Elt(V) 
is constructively well-pointed. 

Proof. Functions 1 X in Se[t(V) are in canonical correspondence with elements 
of X, and a function is monic just when it is injective. Thus, if every map from 1 

factors through a monic, it must be bijective, and hence an isomorphism, so 1 is a 

p 

strong generator. Next, the epics in Se[t(V) are the surjections, and if X — » 1 is 
a surjection, then X must be inhabited, hence p splits. And if 1 = AU B, then the 
unique element of 1 must be in either A or i? by definition of unions, hence either 
A OT B must be inhabited. Finally, has no elements, so 1 is nonempty. □ 

Recall that classically, a topos is said to be well-pointed if 1 is a generator (i.e. 
for f,g:X ^ Y, having fx — gx for all 1 X implies f = g) and there is 
no map 1 — > (1 is nonempty). Thus, any constructively well-pointed topos is 
well-pointed in the classical sense. Conversely, the following is well-known (see, for 
instance, |MLM94[ VI. 1 and VI. 10]). 

Lemma 3.9. Let S be a Heyting category satisfying full classical logic, and in 
which 1 is a nonempty strong generator. Then S is Boolean and constructively 
well-pointed. 

Proof. For any object X, cither X is initial or it isn't. If it isn't, then there must be 
a global element 1 — > A" , since otherwise the monic >—> X would be an isomorphism 
(since 1 is a strong generator). Therefore, if X is not initial, then A' — 1 is split 
epic. Now suppose that X is any object such that A — 1 is regular epic; since 
— > 1 is not regular epic, it follows that A is not initial, and so X 1 must in 
fact be split epic; thus 1 is projective. Also, ii 1 = AU B, then A and B cannot 
both be initial, so one of them has a global element; thus 1 is indecomposable. 

Now let A A be a subobject and assume that A U -^A is not all of X. Then 
since 1 is a strong generator, there is a 1 X not factoring through A U -^A. 
Let V — x*{AU -^A). Then ^ is a subobject of 1. If F is not initial, then it has 
a global element and hence is all of 1, so x factors through A U -^A. But if V is 
initial, then x*{A) must also be initial, which implies that x factors through -lA. 
This is a contradiction, so A U -^A — A; hence S is Boolean. □ 
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Corollary 3.10. Let S be a topos satisfying full classical logic, which is well-pointed 
in the classical sense. Then S is Boolean and constructively well-pointed. 

Proof. In a topos, any generator is a strong generator. □ 

Thus, in the presence of full classical logic, our notion of constructive well- 
pointedness is equivalent to the usual notion of well-pointedness. However, [Proposition 3.8| 
shows that a constructively well-pointed topos not satisfying full classical logic need 
not be Boolean. One can also construct examples showing that in the absence of 
full classical logic, a Boolean topos in which 1 is a nonempty generator need not 
be constructively well-pointed. It is true, however, even intuitionistically, that if 1 
is projective, indecomposable, and nonempty in a Boolean topos, it must also be a 
generator; see jAwo97[ V.3]. 

Other authors have also recognized the importance of explicitly assuming pro- 
jectivity and indecomposability of 1 in an intuitionistic context. In |Awo97j a topos 
in which 1 is projective, indecomposable, and nonempty was called hyperlocal (but 
in |Joh92| Poh02] that word is used for a stronger, non-elementary, property). And 
in [Pal] ■ indecomposability of 1 is assumed explicitly, while projectivity of 1 is 
deduced from a factorization axiom. We note that most classical properties of a 
well-pointed topos make use of projectivity and indecomposability of 1, and many 
of these are still true intuitionistically as long as the category is constructively 
well-pointed. 

Lemma 3.11. Let S be a constructively well-pointed Heyting category. Then: 
(i) A morphism p: Y ^ X is regular epic if and only if every map 1 — > X factors 
through it. 

(ii) Likewise, f : Y ^ X is monic if and only if every map 1 — ^ X factors through 
it in at most one way, and an isomorphism if and only if every map 1 — > A" 
factors through it uniquely. 

(Hi) Given two subobjects A ^ X and B » X, we have A < B if and only if 
every map 1 — > A which factors through A also factors through B. 

(iv) X is initial if and only if there does not exist any morphism 1 A. 



Proof. The "only if" part of (i) follows because 1 is projective. For the "if" part, 
note that a map p : y — > A in a regular category is regular epic iff its image is all 
of X, while if every 1 — > A factors through p then it must factor through im(p) as 
well; hence im(p) is all of A since 1 is a strong generator. 



The "only if" parts of (ii) are obvious, li f : Y — > A is injective on global 
elements, then the canonical monomorphism Y ^ Y bijective on global 

elements, and hence an isomorphism; thus Y is monic. And if / is bijective on 



global elements, then by this and by (i) it must be both monic and regular epic, 
hence an isomorphism. 



The "only if" part of (iii) is also obvious. If every 1 —5- A which factors through 



A also factors through B, then in the puUback 



Ar\B > B 

J 



A > A 

the map AC] B ^ A must be an isomorphism, since 1 is a strong generator; hence 
its inverse provides a factorization of A through B. 
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Finally, the "only if" part of (iv) is the nonemptiness assumption, while if X has 
no global elements, then the map X is bijective on global elements and hence 
an isomorphism. □ 

Remark 3.12. In terms of the internal logic, indecomposability of 1 corresponds to 
the disjunction property (if (/j V V' is true, then either is true or -0 is true), while 
projectivity of 1 corresponds to the existence property (if {3x)ip{x) is true, then 
there is a particular a such that Lp{a) is true). We might also call nonemptiness of 
1 the negation property (± is not true). 

Remark 3.13. (Constructive) well-pointedness has a very different flavor from all 
the other axioms of structural set theory we have encountered so far. In particular, 
it is not preserved by slicing, or by most other categorical constructions. This is to 
be expected, however, since "being the category of sets" is quite a fragile property. 

We have now reached the point where we can define what we mean by a structural 
set theory: an extension of the axiomatic theory describing a constructively well- 
pointed Heyting pretopos. For example: 

• Lawvere's Elementary Theory of the Category of Sets (ETCS), defined 
in [Law64| . is the theory of a well-pointed topos with a nno satisfying full 
classical logic and the axiom of choice. 

• Palmgren's Constructive ETCS (CETCS), defined in [P^, is the theory of 
a constructively well-pointed Il-pretopos with a nno and enough projectives. 

• We will refer to the theory of a constructively well-pointed topos with a nno as 
Intuitionistic ETCS (lETCS). 

Convention 3.14. When working in a structural set theory, we usually write Set 
for the category in question. We call its objects sets and its arrows functions. We 
speak of morphisms 1 ^ X as elements of X, and we write x ^ X synonymously 
for x: 1 ^ X . If/:X— >yisa function and a; G X, we write f{x) for fox: 1 -^Y. 
We speak of monomorphisms S >^ X &s subsets of X and write S C X. For x ^ X 
and S" C X, we write x S and say "x is contained in 5" to mean that 1 ^ X 
factors through S ^ X. Similarly, for S,T C X we write 5 C T to mean that 
S >^ X factors through T ^ X. We also use the following terminology. 

• An arrow- variable x: I X whose domain is 1 is a Ao-variable. 

• An equality (/ = g) of arrow-terms f,g: 1 ~¥ X with source 1 is a Ao-atomic 
formula. 

• A quantifier over a Ao-variable is a Aq- quantifier. 

• A formula whose only variables are Aq- variables, whose only atomic sub formulas 
are Ao-atomic, and whose only quantifiers are Ag-quantifiers is a Aq -formula. 

These conventions make doing mathematics in a structural set theory sound 
much more familiar. They also make it sound very much like the internal logic of 
a category S. Recall that the latter is a type theory with types for all objects of S, 
function symbols for all arrows in S, and relation symbols for all monies in S. The 
following lemma makes this correspondence precise. 

Lemma 3.15. For any Heyting category S, there is a canonical bijection (up to 
provable equivalence) between 

(a) Ao-formulas in the language of categories with parameters in S, and 

(b) formulas in the internal first- order logic ofS. 
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Proof. Given a Ao-formula as in (a) we construct a formula in the internal logic 



by following formally the informal description in 13.141 Note that every arrow-term 
1 X must be constructed as a composite of some number of parameters, possibly 
beginning with a single Ao-variable. (The possibility of nontrivial terms of type 
1 — > 1 can be excluded, up to provable equivalence.) Thus, any such term such 
Bt-s f o (g o x) : 1 ^ X can be represented by a term f{g{x)) : X in the internal 
logic. Similarly, Ap-atomic formulas give atomic equalities between such terms, and 
connectives and Ao-quantifiers translate in the obvious way. 

In the other direction, we have to do a little more work because the internal 
logic usually includes function-symbols of higher arity, corresponding to arrows in S 
whose domain is a cartesian product. Whenever a term such as /(ii, ^2) : Y occurs, 
for terms ti : Xi and ^2 : X2 and an arrow / : Xi x X2 — ?> y in S, in the translation 
we introduce a new Ao-variable z ; 1 — )> Xi x X2 (in addition to those occurring in 
ti and ^2), represent f{t 1,12) by / o z, and carry along an extra stipulation that 
Pi o z = ti and P2 ° z = t2, where pi: Xi x X2 — Xi are the product projections 
in S. This extra condition has then to be placed at an appropriate point in the 
resulting formula, but this process is familiar from the procedure of definitional 
extensions in first-order logic. 

The translation of atomic equalities between terms is obvious, but the internal 
logic includes relation symbols of arbitrary arity, with corresponding atomic for- 
mulas such as R{xi,X2)- However, such an atomic formula can be replaced by the 
Ao-formula (3z G R){pi{z) = xi Ap2{z) — X2), where pi: R ^ Xi are the jointly 
monic projections of the relation i? in S. Thus we can translate all atomic formulas, 
and the extension to connectives and quantifiers is straightforward. □ 

Remark 3.16. Note that in the translation of function symbols of higher arity, the 
object Xi X X2 is now a parameter of the resulting Ao-formula, as are pi and p2- 
Thus, we actually have to choose some particular cartesian product of Xi and X2 
in S. If S doesn't come with "specified" products, then this requires some axiom of 
choice to define the entire bijective correspondence. But we will only need to apply 
the correspondence to particular formulas or finite sets of formulas, in which case 
there is no problem since we only need to make finitely many choices. 

From now on we will identify the two types of formulas whose equivalence is 
shown in ILemma 3.151 The following observation shows that not only do the for- 
mulas themselves correspond, so do their "extensions," in the senses appropriate to 
the internal logic and to structural set theory respectively. 

Proposition 3.17. Let S be a category with finite limits in which 1 is a strong 
generator. Then the following are equivalent. 

(i) S is a constructively well-pointed Heyting category. 

(ii) S satisfies the schema of Ao-separation; for any Ao-formula ip{x) with 
free variable x: 1 ^ X, there exists a subobject S X such that any map 
x: 1 ^ X factors through S if and only if ip{x) holds. 



Proof. Assuming |(i)[ and given a Ao-formula ip as in (ii) we construct S as the 
usual "interpretation" in the internal logic of S of the formula corresponding to 
(p under ILemma 3.151 That is, we build S by induction on the structure of (p, 
using intersections, unions, images, dual images, and so on in S. That this satisfies 
the required property also follows from an inductive argument. The cases of T 
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and A are clear, while and V follow from the assumption that 1 is a strong 
generator. Finally, the cases of 3, V, and _L use the projectivity, indecomposability, 
and nonemptiness of 1, respectively. 



Conversely, assume Ag-separation (ii) and that 1 is a strong generator. The 
argument of lLemma S.ll fii) still applies to show that a morphism is monic iff it is 
injective on global elements. Let Ai denote the class of monies and £ the class of 
morphisms that are surjective on global elements. Because 1 is a strong generator, 
any morphism in £ is extremal epic (i.e. factors through no proper subobject of its 
codomain). Moreover, £ is evidently stable under pullback. 

For any map f : Y ^ X , apply Ao-separation to the formula (Ely £ Y){f{y) ~ x) 
to obtain a monic m: S ^ X. The pullback of m along / is a monic which is 
bijective on global elements, hence an isomorphism; thus / factors through m, and 
the factorization e : y — 5 is in f by construction. Therefore, {£, A4) is a pullback- 
stable factorization system, from which it follows that S is a regular category and 
that £ is exactly the class of regular epics — and hence 1 is projective. 

Now given monies m: A >—> X and n: B ^ X, apply Ap-separation to the 
formula {3a G A){m{a) — x) y {3b G B){n{h) = x) to obtain a monic S --^ X. 



ILemma 3.11 \in) still applies to show that ACS and B <Z S and that if A C T and 



B C_T then S* C T; thus S — AUB. The defining property of S (it contains precisely 
those 1 — > X factoring through either A or B) is evidently stable under pullback. 
Similarly, from the formula ip{x) = _L we obtain a pullback-stable bottom element 
>^ X, so S is a coherent category. Moreover, by the construction of unions and 
empty subobjects, it follows that 1 is indecomposable and nonempty. Finally, dual 
images can similarly be constructed by applying Ao-separation to a formula with 
a universal Ap-quantifier. □ 

Thus, the definition of a constructively well-pointed Heyting category, though it 
may seem categorically technical, is equivalent to a very natural structural analogue 
of the Ap-separation axiom. 



Remark 3.18. If S is a Il-pretopos or a topos, then the direction (b)^(a) of 
ILemma 3.151 can be extended to formulas in the appropriate higher-order logic in- 
volving dependent product types and/or power types, analogously to how we dealt 
with finite products, by choosing appropriate objects in S to introduce as extra 



parameters. Therefore, the direction (i) -)(ii) of |Proposition 3.T7| can be applied to 



such formulas as well. We will need this generalization in what follows. Unfortu- 
nately, it seems difficult to precisely describe a class of formulas in the language 
of structural set theory which would satisfy higher-order versions of lLemma 3.151 
and |Proposition 3.17[ This can be remedied by describing structural set theory as 
a type theory with quantification over types, as mentioned in footnote [2] on page 3] 

4. Structural separation, fullness, and induction 

There are several axioms from material set theory for which we have not yet 
considered structural versions. In this section, we consider separation, fullness, and 
induction; in the next we consider collection and replacement. 

The structural separation axiom simply generalizes |Proposition 3.17|[ii) to un- 
bounded quantifiers. 

• Separation: For any formula ifi{x), '"for any set X , there exists a subobject S X 
such that for any x E X , we have x E S \f and only if f{x)^. 
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Lemma 4.1. // V satisfies the core axioms together with full separation, then 
Se[t(V) satisfies separation. 

Proof. Note that any formula ip in Selt(V) in the language of categories may be 
translated into a formula ^ in V in the language of material set theory. Moreover, 
if if is Ao, then so will cp be. Now, if V satisfies material separation, it is easy to see 
that S — { X ^ X \ (p{x) } has the desired property for structural separation. □ 

The structural axiom of fullness is also a direct translation of the material one. 

• Fullness: '"for any sets X,Y there exists a relation R ^ M x X x Y such that 
R ^ M X X is regular epic, and for any relation S ^ X x Y such that S ^ X \s 
regular epic, there exists an s G M such that (s, 1)*_R C S~'. 

Lemma 4.2. // V satisfies the core axioms together with fullness, then S£t(V) 
satisfies structural fullness. 

Proof. Just like the proofs for exponentials and power sets in [Theorem 3.51 □ 

Remark 4.3. The axiom of fullness appears quite different from our statements 
of the structural axioms of exponentiation and powersets in fJSl Specifically, the 
former refers explicitly to global elements and is thus only suitable in a well-pointed 
category, while the latter are phrased in a more "category-theoretic" way that makes 
sense in more generality. 

In fact, however, in a well-pointed category, the existence of power objects is 
easily shown to be equivalent to the following more "set-like" version: for any X 
there is an object PX and a relation Rx ^ X x PX such that for any subset 
S ^ X, there exists a unique s € PX such that S = (1, s)*Rx- This is also true 
for exponentiation as long as we also assume the collection axioms from the next 
section. Conversely, from our axiom of fullness one can derive a more category- 
theoretic version by interpreting it in the stack semantics. So the difference is only 
an artifact of our chosen presentations. 

The axiom of induction, of course, only makes sense in the presence of the axiom 
of infinity. The structural axiom of infinity (existence of an nno) asserts that 
functions can be constructed by recursion, which implies Peano's induction axiom 
in the sense that any subset S ^ N which contains o : 1 — > iV and is closed under 
s: N ^ N must be all of N. (The proof of lTheorem 3. f^(v)] essentially shows that 
the converse holds in any Il-pretopos.) It follows from Ao-separation that Aq- 
formulas can be proven by induction; the axiom of full induction extends this to 
arbitrary formulas. 

• Induction: For any formula ^{x) with free variable x £ N, where N is an NNO, 
•"if ip{0) and (Vn € N){(p{x) =^ f(sx)), then (p{x) for all x G N^. 

Just as in material set theory, infinity and full separation together imply full in- 
duction. We also have: 

Proposition 4.4. // V satisfies the core axioms of material set theory, and also 
the axioms of infinity, exponentials, and induction, then S€lt(V) has an NNO and 
satisfies induction. 

Proof. Any formula (p{x) in Selt(V) with x £ N = uj can be rewritten as a formula 
in V, to which the material axiom of induction can be applied. □ 
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There is no particularly natural structural "axiom of foundation," although in 
^6] we will mention a somewhat related property. We can, however, formulate a 
structural axiom which is closely related to the material axiom of set-induction. 

• Well-founded induction: For any formula ^p{x) with free variable x G A, '"if A is 
well-founded under the relation -<, and moreover if (p{y) for all y ^ a: implies 1^9(2;), 
then in fact (p{x) for all x G A~'. 

This axiom is implied by separation, since then we can form { a: S v4 | ip{x) } and 
apply the definition of well-foundedness. We can also say: 

Proposition 4.5. // V satisfies the core axioms of material set theory, and also 
the axioms of power set, set-induction, and Mostowski's principle, then S(Elt(V) 
satisfies well-founded induction. 

Proof. With power sets, any well-founded relation can be collapsed to a well- 
founded extensional one (an "extensional quotient" in the sense of 33), which by 
Mostowski's principle will be isomorphic to a transitive set. Thus, set-induction 
performed over the resulting transitive set can be used for inductive proofs over the 
original well-founded relation. □ 

5. Structural collection and replacement 

We now turn to structural versions of the collection and replacement axioms. 
Various such axioms have been proposed in the context of ETCS (see |Col73[ IOsi74[ 
ILawOSi [McL04] ). but none of these seem to be quite appropriate in an intuition- 
istic or predicative theory. Hence our axioms must be different from all previous 
proposals (though they are most similar to the replacement axiom of [McL04| ) . 

The intuition behind structural collection is that since the elements of a set in 
a structural theory are not themselves sets, instead of "collecting" sets as elements 
of another set we must collect them as a family indexed over another set. Also, 
since the language of category theory is two-sorted, it is unsurprising that we have 
to assert collection for objects and morphisms separately. In fact, we find it con- 
ceptually helpful to formulate three axioms of collection, although the third one is 
automatically satisfied. 

• Collection of sets: For any formula (p{u,X), '"for any set U, if for every u E U 

p 

there exists an X with ip{u,X), then there exists a regular epi V — » U and an 
A £ Set/V such that for every v € V we have (p{pv, v*A)~'. 

• Collection of functions: For any formula (p{u,f), '"for any set U and any A,B£ 

Set/U, if for a\\ u E U there exists u*A — ¥ u*B with tf{u, /), then there exists a 

regular epi V — » U and a function p* A — > p*B in Set/F such that for all v eV , 
we have (p{pv , v* g)~' . 

• Collection of equalities: ^For any set U, any A, B <E Set/U, and any functions 
f,g: A ^ B \n Set/U, if u* f ~ u*g for every u <E U, then there is a regular epi 

V ^U such that p* f = p*g.^ 

We will say that Set "satisfies collection" if it satisfies all three of these axioms. 
However, one, and sometimes two, of these are redundant. 

Proposition 5.1. Let Set be a constructively well-pointed Heyting category. Then: 
(i) Set satisfies collection of equalities. 
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(ii) //Set satisfies full separation and is a H-pretopos, then it satisfies collection 
of functions. 

Proof. In the situation of collection of equalities, let E A be the equalizer of / 
and g and let S = VaE, where A U is the structure map of A £ Set/U. The 
assumption that u* f = u*g for every 1 U implies that every such u factors 
through S. Since 1 is a strong generator, this implies S ^ U, and therefore E ^ A 



and so / = g; thus we can take V = U and p = Ijy. This shows (i' 



In the situation of (ii) let C — {B [/)(-4-s-c/) ^j-^g exponential in Set/J7, with 
projection C U. Then each c G C corresponds to a map fc'. {gc)*A — {gc)*B. 

m 

Using the axiom of separation, find a subobject V > — > C such that c e C is 
contained in V iff f{fc)- By assumption, every u £ U lifts to some c £ V, so since 

gm 

Set is well-pointed, the projection V — » U is regular epi. Finally, there is an 
evident map h: {gm)* A — s- {gm)* B such that ip{gmc, c*h) for all c € V. □ 

The appropriate structural formulation of the axiom of replacement is a bit 
more subtle than that of collection. The idea is that if we modify the hypotheses of 
collection by asserting unique existence, then passage to a cover V ^ U should be 
unnecessary. As with collection, we may expect three versions for sets, functions 
and equalities, and of these the second two are easy and follow from collection. 

Proposition 5.2. Let Set be a constructively well-pointed Heyting category. 

(i) Set always satisfies replacement of equalities; '"for any set U, any A, B G 
Set/U, and any functions f,g: A ^ B \n Set/U, if u* f = u*g for every u £ U, 
then / = g^. 

(ii) If Set satisfies collection of functions, then it satisfies replacement of func- 
tions; '"for any set U and any A,B£ Set/U, if for every 1 U there exists 
a unique u*A u*B such that (p{u,f), then there exists A B in Set/U 
such that for each 1 — ^ U we have (p{u,u* f)~'. 

Proof. The proof of [Proposition 5.1|[i~ already shows (i) For (ii) collection of 

p 

functions gives us a regular epimorphism V — » U and a function h: p*A ^ p*B 
in Set/V such that (p{pv, v*h) for any v £ V. li {r, s) : V Xjj V ^ V is the kernel 
pair of p, then for every z = (ui, V2) G V Xu V we have pvi — pv2 — u, say, and 
thus Lp{u,v\h) and Lp{u,V2h). By uniqueness, v\h = and so 

z r ri — v^ri = V211 — z s n. 

By replacement of equalities, r*h = s*h. So since the self- indexing of Set is a 
prestack, h descends to g: A ^ B with p*g — h. Since p is regular epic, for any 
u (z U there exists a v £ V with pv = u, so we have u*h = v*p*h = v*g, whence 
Lp{u,u*h). □ 

These two replacement axioms imply, in particular, that universal properties are 
reflected by global elements. Rather than give a precise statement of this, we present 
a paradigmatic example. 

Proposition 5.3. Let Set be a constructively well-pointed Heyting category satisfy- 
ing replacement of equalities and functions, and suppose we have A, B, E £ Set/X 
and a morphism v: E Xx A ^ B such that for all x € X , x*v exhibits x* E as an 
exponential {x*B)^^ in Set. Then v exhibits E as an exponential B^ in Set/X . 
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Proof. The assumption means that for any object C and any morphism f : C x 
x*A — )• x*B, there exists a unique g: C ^ x*E such that / = x*v o {g x 1). In 
particular, given any D G Set/X and morphism f : D Xx A ^ B, iov every x G X 
there is a unique gx- x*D ^ x*E such that x* f = x*v o {g^ x 1). By replacement 
of functions, we have g: D ^ E such that x* f = x*v o {x*g x 1) for each x e X, 
or equivalently x* f = x*{vo[g x 1)). By replacement of equalities, f = v o {g x 1). 
Moreover, if / = u o (ft x 1) for some h: D ^ E, then for each x € X we have 
x*/ = x*v o (a;*/i x 1). By the universal property of the exponential x*E, we have 
X* h = gx = x*g, and hence h = g hy replacement of equalities. □ 

In future, we will invoke similar facts frequently, trusting the reader to supply 
analogous arguments as necessary. Note also that all universal properties reflected 
in this way are automatically pullback-stable. 

We would also like an axiom of "replacement of sets," which would ensure that 
the existence of an object satisfying a universal property is also reflected by global 
elements. Since no structural theory can determine an object of a category more 
uniquely than up to unique isomorphism, one natural such statement would be: 
• Replacement of sets: '~if for every u & U there is a set A with (fi{u, A) which is 

unique up to unique isomorphism, then there is a B G Set/f7 such that ip{u,u*B) 

for all u G U^. 

If Set is additionally exact, then replacement of sets follows from collection, using 
the fact that in this case the self-indexing Set/(— ) a stack for the regular topology. 
Moreover, just as in material set theory, we have: 

Proposition 5.4. // S is a well-pointed Heyting category which satisfies full clas- 
sical logic and replacement of sets, then it also satisfies separation. 

Proof. For any formula if with a free variable 1 — X, let ^{x, A) be '~A is terminal 
and fix), or A is initial and Since (Va;)(<p(a;) V ^ip{x)) holds by classical 

logic, and initial and terminal objects are unique up to unique isomorphism, we can 
apply replacement of sets to obtain a a B E Set/X such that for any a; G X, if (p{x) 
then x*B is terminal, while if —•(p{x) then x*B is initial. It follows that B X is 
monic, and is the subobject classifying ip required by the separation axiom. □ 

However, for most other purposes replacement of sets is basically iisclcss, since 
hardly ever is a set determined up to absolutely unique isomorphism, only an iso- 
morphism which is compatible with some additional functions whose existence is 
being asserted at the same time. For example, a cartesian product A x B is only 
determined up to an isomorphism which is unique such that it respects the projec- 
tions A X B ^ A and A x B ^ B with which the product comes equipped. In 
order to state a useful version of replacement, we invoke the notion of context from 
dependent type theory (which also simplifies greatly in our particular situation). 

Definition 5.5. Let S be a category. 

(i) A context F in S is a finite (ordered) list of typed variables, with the property 
that whenever an arrow- variable f : X ^ Y occurs in F, each of X and Y is 
either a parameter, or an object-variable occurring in F prior to /. 

(ii) A instantiation A of a context F in S is a well- typed assignation of objects 
and arrows in S to the variables of F. We write A : F and use the notations 
X Xa and (/ : F — >■ Z) i->- (/^ : Ya — >■ Za), where if F or Z is a parameter 
then Ya or Za denotes simply that parameter. 
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(iii) A morphism of instantiations A B consists of 

(a) For each object-variable X vaT, a, morphism ax ■ Xa — > Xb, such that 

(b) For each arrow- variable / : X — >■ K in F, we have ay ° /a = fs ° olx- 
Here if X or y is a parameter, then ax or ay denotes the identity arrow 
of that parameter. 

(iv) If (F, A) is a context (meaning the concatenation of F and A), and A is an 
instantiation of F, then an extension of A to A is a B such that (A, B) is an 
instantiation of A. Similarly we define extensions of morphisms. 

Of course, instantiations of a given, fixed, context can be discussed (and quanti- 
fied over) in the language of categories over S. If <p is a formula whose free variables 
are those in the context F, we write </?(F), and similarly <p(A) for the instantiation 
of ip with these variables replaced by the parameters in A. The pullback of contexts 
and instantiations along a morphism -p: Y ~^\J 'w, defined in the obvious way. 

As a particularly important example, the context [X^x: 1 — >■ X) can be instan- 
tiated in Set/f7 by the pair (J7*?7, Ac/) consisting of the object U*U — U x U and 
the morphism Au : Ijj —> U*U. Moreover, this pair is the universal such instanti- 
ation over U, in that for any u : 1 — ^ [/ we have an isomorphism of instantiations 
u* (U*U, Ajj) = {U,u). Similarly, for any we can consider {V*U, {lv,p)), 

which has the analogous property that v*{V*U, (ly,p)) = {U,pv) for any v. 1 V. 

Proposition 5.6. Any constructively well-pointed Heyting category satisfying col- 
lection also satisfies collection of contexts: for any context {X, x: 1 — >■ A", F) and 
any formula (p{X, x, T), '"for any set U, if for every u € U there exists A : F extending 
{U,u) such that (p{U,u,A), then there exists a regular epi V — » U and a B : T 
extending {V*U, (ly,p)) in Set/V such that for every u G we have (p{U,pv, v*B)~'. 

Proof. Simply apply collection of sets and functions repeatedly, using the fact that 
regular epimorphisms compose. □ 

We can now improve "replacement of sets" to a more useful axiom. 
• Replacement of contexts: for any context {X,x: 1 — >■ A, F) and any formula 
(f{X,x,T), '"for any set U, if for every u E U there is an extension A : T of 
{U,u) such that Lp{U,u,A), and moreover A is unique up to a unique isomorphism 
of instantiations extending Ijj, then there is an extension i? : F of {U*U,Aij) in 
Set/U such that ip{U,u,u*B) for all u e U^. 

Proposition 5.7. Any constructively well-pointed Heyting pretopos satisfying col- 
lection also satisfies replacement of contexts. 

Proof. By |Proposition STG} there is a regular epi p: V ^ U and a C : F in Set/V 
such that for every w e we have ip{U,pv,v*C). Let {r,s): V Xjj ^ ^ be 
the kernel pair of /, and consider r*C and s*C in Set/V Xjj V. The assumption 
implies that when pulled back along any z: 1 ^ V Xjj V , these two instantiations 
of F become uniquely isomorphic. Thus, by replacement of functions and equalities 
applied some finite number of times, we actually have a unique isomorphism r*C = 
s*C in Set/V XifV. Uniqueness implies that this isomorphism satisfies the cocycle 
condition over V Xjj V Xjj V . Thus, since Set is a stack for its regular topology 
(applied some finite number of times), the entire instantiation C : F descends to 
some B . T in Set/U. Since p is surjective, the desired property for B follows. □ 
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In general, it seems that replacement of contexts does not imply collection, al- 
though we do not have a counterexample. As in material set theory, however, 
replacement suffices in the classical world. 

Proposition 5.8. Over ETCS, the following are equivalent. 

(i) Replacement of contexts, 
(ii) Collection of sets. 

(Hi) Full separation and collection (of both sets and functions). 



Proof. By Propositions I5.]|(ii)[ 15.41 and 15.71 it suffices to prove that replacement 
of contexts implies collection of sets. Given a formula ip{u^X), we can construct 
a context T including both a set X and a binary relation on it, and let '0(u,r) 
assert that if{u,X) holds and that the given relation is a well-ordering, which 
has the smallest possible order-type among well-ordered sets X such that Lp{u,X). 
Since classically, any set admits a smallest well-ordering which is unique up to 
unique isomorphism, we can apply replacement of contexts to ijj and thereby deduce 
collection of sets. □ 

As promised, replacement of contexts implies that the existence of objects satis- 
fying a universal property is reflected by global elements. Continuing the example 
of [Proposition 5. 3} we have the following. 

Proposition 5.9. Let Set be a constructively well-pointed Heyting pretopos satis- 
fying collection. If Set is cartesian closed, then it is locally cartesian closed. 

Proof. Let A,B £ Set/X; we want to construct the exponential {B — > X)^"^^'^\ 
For X £ X, let ip{x, E, e) assert that e : Exx*A — > x*B exhibits E as the exponential 
{x*BY ^ ■ This formula can be phrased as '>\)(X, x, F) for some F, although we note 
that F involves not just E and e but also object- variables for x* A, x*B, and Exx*A, 
and arrow-variables giving the projections that exhibit these as two puUbacks and 
a cartesian product, respectively. 

Now, since Set is cartesian closed, for every x G X there exists E and e with 
ip{x, E, e), and such are unique up to a unique isomorphism which respects all 
the structure. Therefore, replacement of contexts supplies an instantiation of F 
extending {X*X, Ax) in Set/X. This consists essentially of an object C and a 
morphism c: C Xx A ^ B. The conclusion of replacement of contexts implies that 
C and c satisfy the hypotheses of [Proposition 573} so they must be an exponential 
{B as desired. □ 

This is of course reminiscent of the way in which local cartesian closure comes 
"for free" in lTheorem S.^ FiT We end this section by extending [Theorem 3. 5 1 to the 



axiom of collection. 

Theorem 5.10. //V satisfies the core axioms of material set theory along with 
collection, then S€lt(V) also satisfies collection. 

Proof. If V satisfies material collection, then given the setup of collection of sets 
for some formula (p, let ijj{u,X) assert that X is a Kuratowski ordered pair of the 
form (zi, X') with (p{u, X'). By material collection, let F be a set such that for any 
u € U, there is an X e y with ip{u, X), and for any X gV, there is a u G C/ with 
iIj{u,X). Then every element of V is an ordered pair whose first element is in U, 
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SO there is a projection V ^ U , which by assumption is surjective. We can then 
form B = IJj^ X')£V ^' ^ ^^"^ Ao-separation cut out 



Then A e Selt(V)/F, and for any v = {u,X') e V, v*A is isomorphic to X'. Thus, 
by isomorphism-invariance, we have f{u, v*A), as required. Collection of functions 



The material axiom of replacement, however, does not seem to imply the struc- 
tural one. This, we feel, is one of the reasons (though not the only one) that the 
material axiom of collection is necessary in practice. 



So far we have summarized the axioms of material set theory and structural 
set theory, and explained how most axioms of material set theory are reflected in 
structural properties of the resulting category of sets. We now turn to the opposite 
construction: how to recover a material set theory from a structural one. A "set" 
in material set theory, of course, contains much more information than a "set" in 
structural set theory, namely the membership relations between its elements, their 
elements, and so on. This gives rise to the idea of modeling a "material set" by a 
graph or tree with nodes depicting sets and edges depicting membership. 

This basic idea was used by |Col731 IMit721 IOsi74j in the first equiconsistency 
proofs of ETCS with BZC, and nearly identical constructions have been used for 
relative consistency proofs by others such as jAcz88 and [ MatOl, . We are not aware 
of an exposition at our required level of generality, though. The constructions are 
the same as always, though, as long as we are careful about the definitions. 

For the rest of this section, let Set be a constructively well-pointed Il-prctopos 
with an nno. 

Definitions 6.1. 

(i) A grapii is a set X, whose elements are called nodes, equipped with a binary 
relation ^. 

(ii) If a; ^ y we say that x is a child of y. 

(iii) A pointed graph is one equipped with a distinguished node * called the root. 

(iv) A pointed graph is accessible if for every node x there exists a path x — 
a;„ -<•••-< xq = to the root. 

(v) For any node x of a graph X, we write X/x for the full subgraph of X 
consisting of those y admitting some path to x. It is, of course, pointed by x, 
and accessible. 

"Accessible pointed graph" is abbreviated APG. 

Remark 6.2. The hypothesis on Set is necessary to formalize "accessibility" and 
to define X/x. Specifically, a pointed graph X^ >^ X x X with root *: 1 ^ X is 
accessible if for every x: 1 — > X, there exists a nonzero finite cardinal [n] and a map 
[n] —> X^ realizing a path from x to (Recall that a finite cardinal is the pullback 
along a map 1 — ;> of the second projection N oi the strict order relation 

on the NNO.) The definition of X/x is similar, using the extension of Ao-separation 



A = { ((u, X'), a)eVxB\aeX'}. 



is analogous. 



□ 



6. Constructing material set theories 



to functions described in 
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We are using the terminology of jAcz88j . The idea is that an arbitrary graph 
represents a coUection of material-sets with -< representing the membership relation 
between them, a pointed graph represents a particular set (the root) together with 
all the data required to describe its hereditary membership relation, and an APG 
does this without any superfluous data (all the nodes bear some relation to the 
root). Thus, an arbitrary APG can be considered a picture of a possibly non- well- 
founded set: the root represents the set itself, its children represent the elements of 
the set, and so on. 

We will henceforth restrict attention to graphs for which -< is well-founded, 
thereby ensuring that the models of material set theory we construct satisfy the 
axiom of foundation. It is also possible, by changing this requirement, to construct 
models satisfying the various axioms of anti- foundation (see |Acz88| ). but we will 
not do that here. Recall the definition: 

Definition 6.3. A subset 5* of a graph X is inductive if for any node x & X, ii 
all children of x are in S, then x is also in S. A graph X is well-founded if any 
inductive subset of X is equal to all of X. 

In the presence of classical logic, well-foundedness is equivalent to saying that 
every nonempty subset of X has a ^-least element, but in intuitionistic logic that 
version is both fairly useless and rarely satisfied. 

With the above definition of well-foundedness, we can perform proofs by in- 
duction on a well-founded graph: by proving that a given subset is inductive, we 
conclude it is the whole graph. In order to prove a statement by well-founded in- 
duction, we must apply separation to the statement to turn it into a subset; thus 
either the statement must be Aq or we must have a stronger separation axiom. We 
can also use well-founded induction in more than one variable, since if X and Y 
are well-founded then so is X x Y. 

We record some observations about well-founded graphs. 

Lemma 6.4. Any subset of a well-founded graph is well-founded with the induced 
relation. 

Proof. For any Z C X, if S* C Z is inductive in Z, then the Heyting implication 
{Z ^ S) CX is inductive in X. □ 

Lemma 6.5. If X is a well-founded graph, then there does not exist any cyclic 
path X = Xn ^ ■ ■ ■ ~< xq — X in X . 

Proof. If there were, then the Heyting complement of {xq, . . . , x„} C X would be 
inductive but not all oi X. □ 

Lemma 6.6. If X is a well-founded graph and x G X, then x: 1 — t- X/x is a 
complemented subobject. In particular, it is decidable whether or not a node of a 
well-founded APG is the root. 

Proof. By definition, every node y £ X/x admits some path to x, of length n G N 
say. Since is a complemented subobject of iV, either n = 0, in which case y = x, 
or n > 0. If n > 0, then if x — y there would be a cyclic path from x to itself; hence 
in this case x ^ y. Thus for all y, either y — x or y ^ x, as desired. □ 

Definition 6.7. We will write X//x for the complement of x in X/x, i.e. the set of 
nodes admitting a path to x of length > 0. In particular, X //-k is the complement 
of the root. 
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We need one more requirement on our APGs, namely that they satisfy the axiom 
of extensionahty. 

Definition 6.8. An graph X is extensional if whenever x and y are nodes such 
that z ^ X <^ z ^ y for all z, then x — y. 

For non-well-founded graphs, this definition would have to be strengthened in 
one of various possible ways. 

Remark 6.9. An equivalent characterization of the universe of extensional well- 
founded APGs can be obtained by working with well-founded rigid trees instead. A 
tree is an APG in which every node x admits a unique path to the root, and it is 
rigid if for any node z and any children x ^ z and y ^ z/ii X/ x = Xj y, then x = y. 
Every extensional well-founded APG X has an "unfolding" into a well-founded rigid 
tree X', whose nodes are the paths in X, and conversely every well-founded rigid 
tree is the unfolding of some extensional well-founded APG. Rigid trees are used 
by [Col73| IMit72| and |MLM94j . while extensional relations are used by |Osi74| 
and I Joh77j . but they result in essentially equivalent theories. (In the non- well- 
founded case, however, extensional relations seem more generally applicable than 
rigid trees.) 

We now record some observations about extensionahty and its interaction with 
well-foundedness. 

Definition 6.10. An initial segment of a graph AT is a subset F C A such that 
X < y implies x . 

Lemma 6.11. Any initial segment of an extensional graph is extensional with the 
induced relation. □ 

Lemma 6.12. If X is a well-founded extensional graph and X/x = X/y, then 
x = y. 

Proof. We prove this by well-founded induction. If g: X/x ^ X/y, then for all 
x' ^ X we have X/x' = X/g(x'), where g{x') -< y; hence by induction x' = g{x'). 
Similarly, we have y' = g~^{y') for all y' -< y. By extensionahty, x = y. □ 

In the language of [Acz88j . [Lemma 6.12l savs that well-founded extensional graphs 
are "Finsler-extensional." 

Lemma 6.13. Any automorphism of a well-founded extensional graph is the iden- 
tity. Therefore, any two parallel isomorphisms of well-founded extensional graphs 
are equal. 

Proof. Let / : X ^ X be an isomorphism; we prove by well-founded induction 
that f{x) — X for all x ^ X. But if f{x') = x' for all x' -< x, then extensionahty 
immediately implies f{x) = x. □ 

Definition 6.14. We write V(Set) for the class of well-founded extensional APGs 
in Set. 

Our goal is now to show that V(Set) is a model of a material set theory. We 
consider two APGs to be equal, i.e. to represent the same material-set, when they 
are isomorphic. And we model the membership relation G in the expected way: 
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Definition 6.15. If X is an APG, the children of its root are cahed its members. 
We write \X\ for the set of members oi X. li X and Y are APGs, we write X eY 
to mean that X = Y/y for some member y G \Y\. 

Here is our omnibus theorem. 

Theorem 6.16. Let Set be a constructively well-pointed H-pretopos with a nno, 
and let ip be a formula of material set theory with parameters in V(Set). Then 
V(Set) 1= (p whenever any of the following holds. 

• (p is the axiom of extensionality, empty set, pairing, union, exponentiation, in- 
finity, foundation, transitive closures, Mostowski's principle, or an instance of 
Ao-separation. 

• Set satisfies structural fullness and ip is material fullness. 

• Set is a topos and p is the power set axiom. 

• Set satisfies structural separation and ip is an instance of material separation. 

• Set satisfies structural collection and p is an instance of material collection. 

• Set satisfies replacement of contexts and (p is an instance of material replace- 
ment. 

• Set is Boolean and p is an instance of Aq- classical logic. 

• Set satisfies full classical logic and (p is an instance of full classical logic. 

• Set satisfies induction and ip is an instance of full induction. 

• Set satisfies the axiom of choice and p is the material axiom of choice. 

• Set satisfies well-founded ind,uction and p is an instance of set-induction. 

We will prove this theorem with a series of lemmas, but first we need to introduce 
some auxiliary notions leading up to the construction of extensional quotients. 

Definition 6.17. Let X and Y be graphs. A simulation from X to y is a function 

f: X ^Y such that 

(i) if x' ^ X, then f{x') -< f{x), and 

(ii) if y ^ f{x), then there exists a.n x' -< x with f{x') = y. 

A bisimulation from X to F is a relation R X xY such that both projections 
R ^ X and i? — > F are simulations (where R is considered as a full subgraph of 
X xY). A bisimulation is bi-entire ii R ^ X and R Y are surjective. 

Note that if / : X — >■ y is a simulation, then the relation >-Xxyis 
a bisimulation, which is bi-entire iff / is surjective. 

An obvious example of a simulation is the inclusion of an initial segment. The 
following lemma says that for well-founded extensional graphs, these are the only 
simulations. 

Lemma 6.18. If X is well-founded and extensional, then any simulation f : X 
Y is infective, and isomorphic to the inclusion of an initial segment. 

Proof. We show by well-founded induction that f{x\) = f{x2) imphes x\ = X2. 
Suppose f{xi) = f{x2)\ then for any zi -< xi, we have f{zi) ~< f{xi) = f{x2), 
so since / is a simulation there is a ^2 ^ a^2 with f{z2) = f{zi). Hence zi = Z2 
by induction, so Zi -< X2. Dually, Z2 -< X2 implies Z2 -< Xi, so by extensionality 
xi = X2. Finally, any injective simulation must be an initial segment. □ 

Lemma 6.19. If R is a bi-entire bisimulation from X to Y, then X is well-founded 
if and only if Y is so. 



30 



MICHAEL A. SHULMAN 



Proof. Suppose X is well-founded and 5 C F is inductive. Let T C X consist of 
those X G X such that R{x, y) implies y S; we show that T is inductive. Suppose 
X (Iz X is such that x' ^ x implies x' G T , and suppose that R{x, y). Then for any 
y' < y there is a,n x' ^ x with R{x' , y'), whence x' G T and thus y' G S. So since S 
is inductive, y must be in S. Thus x G T, so T is inductive. Since X is well-founded, 
T = X, and then since R is bi-entire, S — Y; thus Y is well-founded. □ 

Lemma 6.20. Any bi-entire bisimulation between extensional well-founded graphs 
must be an isomorphism. 

Proof. Let R ^ X y.Y he such. We show by well-founded induction that if yi) 
and R{x,y2), then yi — y2. For if zi -< yi, then since i? is a bisimulation, there is 
a. w ^ X with i?(w, zi), and again since i? is a bisimulation, there is a Z2 -< y2 with 
R{w, Z2). By induction, zi = 22, so that zi -< 2/2 for any zi ^ yi. By symmetry, for 
any Z2 -< y2 we have Z2 ^ j/i, hence by extensionality yi — y2- 

By symmetry, if R(xi,y) and R{x2,y) then xi = 0:2, so i? is functional in both 
directions. Since it is also bi-entire, it must be an an isomorphism. □ 

Lemma 6.21. If X is well-founded, then it is extensional if and only if every 
bisimulation from X to X is contained in the identity. 

Proof. Suppose first that X is well-founded and extensional and that i? is a bisim- 
ulation with R{xi,X2). Then i? is a bi-entire bisimulation from X/xi to X/x2 (by 
ordinary induction on length of paths) , so by ILemma 6.201 it must be an isomor- 
phism X/xi ^ X/x2. But X is well-founded and extensional, so bv ILemma 6.12( 

Xi = X2. 

Now suppose that every bisimulation from X to X is contained in the identity, 
and also that x,y G X are such that z ^ x z -< j/ for all z. Define R{a, b) to hold 
if either a — b, or a — x and b — y. Then i? is a bisimulation, and if it is contained 
in the identity, then x = y; hence X is extensional. □ 

In the language of |Acz88| , ILemma 6.211 says that for well-founded graphs, ex- 
tensionality is equivalent to "strong extensionality." 

Corollary 6.22. // Y is well-founded and extensional, then any two simulations 
f,g: X ^ Y are equal. 

Proof. The image of (/, 5) : X — 5- y x F is a bisimulation, hence contained in the 
identity. □ 

Therefore, well-founded extensional graphs and simulations form a (large) pre- 
order. In the language of material set theory, this preorder represents the partial 
order of transitive-sets and subset inclusions. 

Lemma 6.23. If X is a graph and R is a bisimulation from X to X which is an 
equivalence relation, then its quotient Y inherits a graph structure such that the 
quotient map [— ] : X ^ Y is a simulation. Also, if X is an APG, then so is Y. 

Proof. Define ^ on K to be minimal such that [— ] preserves -<, i.e. yi ~< y2 if there 
exist xi ^ a;2 in X with [xi] = yi and [X2] = j/2- Now suppose that y ^ [x]. By 
definition this means that there exist zi -< Z2 with [zi] — y and [Z2] — [x], i.e. 
R{z2,x) holds. But fi! is a bisimulation, so there exists x' ^ x with R{zi,x'), i.e. 
\x'] = y\ hence [— ] is a simulation. If X is an APG, we define the root of Y to be 
[*] ; accessibility of Y follows directly from that oi X . □ 
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Of course, bv lLemma 6.19| if X is well-founded, then so is the quotient Y . If R is 
the largest bisimulation on X, then its quotient is easily verified to be extensional. 
The largest bisimulation exists if Set is a topos, or if it satisfies full separation, so in 
these situations every well-founded graph has an extensional quotient. In general, 
this seems not to be provable, but we can still construct extensional quotients in a 
useful amount of generality. 

Lemma 6.24. Let n he a fixed external natural number, let X he a well-founded 
APG, and assume that X/x is extensional whenever x is a node that admits a path 
of length n to the root. Then there is an extensional well-founded APG X and a 
surjective simulation q: X — > X. 

Proof. The proof is by external induction on n. (We will only need this lemma for 
rt < 3, so the reader is encouraged not to worry too much about what this induction 
requires of the metatheory.) The base case is easy: since the root * admits a path 
of length to itself and X = X/-k, we can take X = X. 

Now suppose the statement is true for some n, and let X satisfy the hypothesis 
for n + 1. For any fc, write X^ for the set of nodes admitting a path of length 
k to the root. Let the relation i? on X be defined by R{x, y) if there exists an 
isomorphism X/x ^ X/y. (This can be constructed using Ao-separation and local 
exponentials in Set.) Then i? is a bisimulation and an equivalence relation, so by 
ILemma 6.231 it has a quotient Y which is again a well-founded APG. 

We claim that Y satisfies the hypothesis for n. Let y G F„ and suppose that 
2/1:2/2 S Y/y satisfy z -< yi <^ z ^ y2 ; we must show yi — y2 • Applying the 
simulation property inductively, we have y = [x] for x £ X„, and yi = [xi] with 
Xi e X/x for i = 1,2. Bv ILemma 6.61 for each i either Xi = x or Xi € X/wi for 
some Wi -< X. If xi = a; and X2 = x, then of course j/i — [xi] = [X2] =2/2- If 
Xi = X and X2 G X/w2 with W2 -< x = X2, then there would be a cyclic path in X 
from X2 to itself, contradicting iLemma 6.5l Hence the only remaining case is when 
Xi e X/wi with Wi < X for both i = 1, 2. 

Now this implies that Wi G X„+i, so each X/wi is extensional, and thus so is each 
X/xi bv ILemma 6.111 Therefore, bv ILemma 6.181 the quotient map [—]: X ^ Y 
induces an isomorphism X/xi = Y/[xi] = Y/yi. But z ^ yi <^ z ^ y2 means that 
Y //yi = Y //y2, and hence (bv ILemma 6.6p also Y/y\ = Y/y2\ thus we also have 
X/x\ = X/x2. Thus, by definition, i?(a;i,X2), and so y\ — [xi] = [X2] = 2/2- 

We have shown that Y satisfies the hypothesis for n. Thus it has an extensional 
quotient Y, and so the composite X Y ^ Y is an extensional quotient of X. □ 

We can now start verifying the axioms of material set theory. 

Lemma 6.25. The axiom of extensionality holds. That is, two well-founded ex- 
tensional APGs X and Y are isomorphic iffZeX^ZeY for all Z . 

Proof. The "only if" direction is clear, so suppose that Z e X Z e Y ioi all 
Z. Then for every x G \X\, we have X/x e Y, hence X/x = Y/y for some y eY . 
By ILemma 6.121 this y must be unique, and conversely as well; hence we have a 
bijection g: \X\ ^ \Y\ such that for any x G \X\ there exists an isomorphism 
h^: X/x ^ Y/g{x) (which must be unique, bv lLemma 6.131) . Define a relation R 
from X to Y such that R{a, b) holds if: 

(i) a = -k and & = *, or 

(ii) there exists x G |X| such that a G X/x, b G Y/g{x), and hx{a) = b. 
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Then i? is a bi-entire bisimulation, so by ILemma 6.201 it is an isomorphism. □ 

Lemma 6.26. The axioms of empty set, pairing, and union hold. 

Proof. The empty set is represented by the APG with one node and no -< relations, 
which has no members. 

If X and Y are extensional weh-founded APGs, let Z ^ X + Y + 1 with -< 
induced from X and Y along with -kx -< * and ★y- -< *, where * is the new point 
added. Since X and Y are extensional, Z satisfies the hypothesis of ILemma 6.241 
with n = 1, and its extensional quotient represents the pair {X, Y}. 

Finally, if X is an extensional well-founded APG, let \\X\\ denote the subset of 
those X G X such that x -< y -< * for some y, let Y be the subset of X consisting 
of those nodes admitting some path to a node in \\X\\, and define Z = Y + 1 with 
-< inherited from Y and with y ^ * for each y G \\X\\ C Y, where * is the new 
element added. Then Z satisfies the hypotheses of ILemma 6.241 with n = 1, so it 
has an extensional quotient, which is the desired union [JX. □ 

Lemma 6.27. Cartesian products (using Kuratowski ordered pairs) exist in V(Set). 
Proof. Let X and Y be well-founded APGs, and consider the set 

z = (x/A) + (y//*) + \x\ + i\x\ X + i\x\ x + l 

For a; S |X| we write x for its image in {X//-k) and x' for its image in the first copy 
of \X\. Similarly, we write y for images in Y jj-k, {x, y) for images in the first copy 
of \X\ X {x,y)' for images in the second copy, and ★ for the final point. We 
define ^ on Z as follows: 

• < on X jj-k and Y jj-k is induced from X and Y . 

• X < x' for all x G 

• X < (x,y) and y < (x,y) for all y S \Y\. 

• x' < {x,y)' and (x,y) < {x,y)' for all x £ \X\ and y G \Y\. 

• (x,y)' -< * for all x e \X\ and y £ 

It is straightforward to verify that Z is then a well-founded APG. Since X and Y are 
extensional, Z satisfies the hypothesis of ILemma 6.241 with rt = 3. Its extensional 
quotient then represents the cartesian product of X and Y . □ 

Lemma 6.28. V(Set) satisfies the exponentiation axiom. 

Proof. If X and Y are extensional well-founded APGs, let Z be their material carte- 
sian product as above, and define 

= (z//*) + |ypi + 1 

with -< induced from Z along with (using the notation of ILemma 6.27|) {x,y)' -< f 

I X I 

whenever f{x) — y, and / ^ 7k- for any / G '. Then W is a well-founded APG, 
and in fact is already extensional; we claim it represents the material function-set. 

It is clear that if _F e W, then F G V(Set) is a function from X to F in the 
sense of material set theory. Conversely, from any F G ¥(861) which is a function 
from X to Y, consider the subset of |X| x |y| determined by those {x, y) such that 
the Kuratowski ordered pair {{X/x},{X/x,Y/y}} is e F. This defines a function 
\X\ —}' \Y\ in Set, which therefore induces an / G \W\ such that F = W/f. □ 
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Observe that in particular, we have shown that for X,Y E V(Set), there is a 

I- 1 correspondence between functions \X\ \Y\ in Set and isomorphism classes of 
APGs F G V(Set) which represent functions from X to y in the sense of material 
set theory. In fact, although V(Set) need not satisfy limited Ao-replacement, so 
that [Theorem SiSl does not apply to it directly, we still have: 

Lemma 6.29. The sets and functions in V(Set) form a category Se[t(V(Set)), 
which can naturally be identified with a full subcategory of Set closed under finite 
limits, subsets, quotients, and local exponentials. In particular, Se[t(V(Set)) is a 

II- pretopos. 

Proof. We have observed closure under products and non-local exponentials. Clo- 
sure under subsets is easy: if [/ C \X\, then the sub-graph Y of X consisting of the 
root and all nodes admitting a path to C/ is a well-founded extensional APG with 
\Y\ = U. This then implies closure under finite limits. 

q 

For quotients, if R is an equivalence relation on \X\, let \X\ — » Y be the quotient 
of |X| by i? in Set; then the APG 

Z = {X//ir)+Y+l, 

with -< inherited from X along with x -< q{x) and y ~< * for all x € |X| and y CiY, 
is well-founded and extensional and has \Z\ = Y. 

Finally, given /: |^| — >■ \B\ and g: \X\ — > \A\, we have the local exponential 
h: Hfig) \B\ in Set, with counit e: ^f{g) '>^\b\ 1^1 ~^ Let Z represent the 
material cartesian product of A and X as in ILemma 6.27[ and consider the APG 

W^{Z//*)+Uf{g) + l 

with -< inherited from Z, along with (x, y)' -< j whenever f{x) = h{j) and e{j, x) = 
y, and j -< ★ for all j € Ilf{g). Then W is well-founded and extensional and 
\W\ = Ilf{g): hence Se[t(V(Set)) is closed under local exponentials. □ 

We return to verifying the axioms of material set theory. 

Lemma 6.30. // Set satisfies structural fullness, then V(Set) satisfies material 
fullness. 

Proof. Analogously to exponentiation, ii R M x X xY is a. generic set of multi- 
valued functions from \X\ to consider 

W^{Z//ir)+M+l 

with -< induced from Z along with (x, y)' ^ m if R{m, x, y) and m -< for all m £ 
M. Then is a well-founded APG and satisfies the hypothesis of lLemma 6.24l with 
n — 1. Its extensional quotient represents a generic set of multi- valued functions, 
by a similar argument as for exponentiation. □ 

Lemma 6.31. // Set is a topos, then V(Set) satisfies the power set axiom, and 
SE[t(V(Set)) C Set is a logical subtopos. 

Proof. For an extensional well-founded APG X , define 

y = (x//*) + p|x| + * 

with ^ induced from X along with x ^ A whenever x G A g -PI-^'^Ij and x E A; 
and also of course A ^-k. This is an extensional well-founded APG that represents 
the material power set of X. The second statement is immediate. □ 
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Lemma 6.32. V(Set) satisfies the axiom of infinity. 

Proof. Let ui = N + 1, with -< defined to be < on together with n ^ * for all 
n £ N. This is an extensional well-founded apg which represents the von Neumann 
ordinal ui. The infinity axiom follows from the universal property of the NNO. □ 

Lemma 6.33. //Set satisfies the axiom of choice, then so does V(Set). 

Proof. Let X be a well-founded extensional apg such that X // x is inhabited for 

each a; G If y C X x |X| consists of those (y, x) such that y & X //x, then the 
projection F — >■ \X\ is surjective, and hence has a section, say s. From s we can 
easily construct a material choice function for X. □ 

Lemma 6.34. Set has transitive closures. 

Proof. If X is a well-founded extensional APG, let T = {X/j-k) + 1 with -< inherited 
from X along with a; ^ ★ for all nodes x & X (not just all members). Then T is a 
well-founded extensional apg which represents the transitive closure oi X. □ 

Lemma 6.35. Set satisfies Mostowski's principle. 

Proof. Since Selt(V(Set)) is closed in Set under finite limits and subsets, any well- 
founded extensional graph X constructed in the material set theory V(Set) will 
induce such a graph in Set. Therefore, X + 1, with ^ induced from X along with 
a; -< ★ for all nodes x £ X, is a well-founded extensional apg, i.e. an object of 
V(Set). We then verify that it is transitive and isomorphic to X in V(Set). □ 

We now turn to the axiom schemata. For these, we need to be able to translate 
material formulas into structural ones. There is an obvious way to do this: if (p is 
a formula in V(Set), we define (p^ in Set as follows: 

• We replace the material "equality" symbol = by isomorphism = of APGs. 

• We replace the material "membership" symbol e by the relation e. 

• The connectives are unchanged. 

• We replace quantifiers over material-sets by quantifiers over well-founded ex- 
tensional APGs. For example, {3x)(p{x) becomes ''there exists a well-founded 
extensional apg X such that (pf {X)~'. 

It is easy to see that V(Set) 1= if and only if Set 1= (fe- This translation works 
quite well for the schemata involving arbitrary formulas. 

Lemma 6.36. 7/ Set satisfies separation, then so does V(Set). 

Proof. Let ip{x) bo a formula and A G V(Set). Using separation, let U C \A\ 
consist of precisely those a G ^4 such that (pe{A/a). Define B to consist of the root 
of A together with all nodes admitting a path to some node in U. Then B is a 
well-founded extensional APG, and for any C e A we have C e _B iff (p^{C). □ 

Lemma 6.37. //Set satisfies full classical logic, then so does V(Set). 

Proof. Classical logic for Set implies V -h^^ for any formula (fi in V(Set). □ 

Lemma 6.38. If Set satisfies collection, then so does V(Set). 
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Proof. Suppose that A e V(Set) and that is a formula such that for any X e A, 

there exists a F S V(Set) with tf{X,Y). This means that for any x G \A\, there 

exists a well-founded extensional APG Y such that (p^ {A/x, Y). By collection in Set, 

p 

there is a surjection V — » \A\ and a pointed graph B S Set/V (here "pointed" 
means we have a section s: V ^ B over V) such that for each v € V, v*B is 
a well-founded extensional APG and (pi{A/p{v),v*B). It is easy to show that B, 
considered as a graph in Set, is still well-founded. And since B is a graph in Set/V, 
its relation -< is fiberwise; thus for each v G V we have B/s{y) = v*B, which is 
therefore extensional and accessible. It follows that S + 1, with s{v) -< * for all 
V G V, satisfies the hypotheses of lLemma 6.241 with n = 1. Its extensional quotient 
is then the set desired by the material collection axiom. □ 

Lemma 6.39. // Set satisfies replacement of contexts, then V(Set) satisfies ma- 
terial replacement. 

Proof. Suppose that A € V(Set) and that ip is a formula such that for any X e A, 
there exists a unique Y S V(Set) with ip{X, Y). Thus, for any x S \A\, there exists 
a well-founded extensional APG Y such that (pe{A/x,Y), and any two such Y are 
isomorphic. Since any such isomorphism is unique bv lLemma 6.131 replacement of 
contexts in Set supplies a pointed graph B € Set/|^| such that for each a:; G |^| 
we have (pe{A/x,x*B). The extensional quotient of B -|- 1 then represents the set 
desired by material replacement. □ 

Lemma 6.40. //Set satisfies full induction, then so does V(Set). 

Proof. If (p{x) is as in the statement of the material induction axiom, then (pe{X) 
is a statement about some X e uj, i.e. X G N. But every X e N is isomorphic to 
N/n for a unique n S TV, so feiX) is equivalent to a statement (p'^{n) about some 
n G N, which can then be proven by the structural induction axiom. □ 

Lemma 6.41. // Set satisfies well-founded induction, then V(Set) satisfies set- 
induction. 

Proof. Just like ILemma 6.401 using induction over the well-founded (extensional) 
relation in Set that underlies any object of V(Set). □ 

The schemata involving Ag-formulas require a little more work, since if ip is Aq 
then ipf: need not be. Thus, we need to define a different translation for Ao-formulas. 
Suppose (/5 is a Ap-formula in V(Set) with parameters Ai, . . . , Ak, each of which is 
a well-founded extensional APG. Then 

Ai + --- + Ak + l, 

with -< inherited from the Ai along with ^ ★ for all 1 < « < A:, satisfies the 
hypothesis of ILemma 6.241 with n = 1. Let T be its extensional quotient. We can 
now translate tp into a Ao-formula as follows, interpreting material-set variables 
not by APGs but by elements of T. 

• Each parameter Ai is replaced by G T. 

• The material "equality" symbol = is replaced by equality in T. 

• The material "membership" symbol G is replaced by -< in T. 

• The connectives are unchanged. 

• A Ao-quantifier of the form {3x G y)p is replaced by a Ao-quantifier of the form 
(3a; G T){x ^ y /\ p) . Similarly, (Va; G y)p is replaced by (Va: G T)(x ^ y ^ p) . 
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We call the formula produced in this way ip'^° . 
Lemma 6.42. Lp^ is equivalent to 

Proof. ILemma 6.121 implies that T/x ~ T/y if and only if x — y. Similarly, if 
T/x e T/y, then T/x = {T/y)/y' = T/y' for some y' -< y, whence x — y' and so 
X ^ y. The converse is easy, so T/x e T/y if and only if x ^ y. Thus the atomic 
formulas correspond, and the connectives evidently do, so it remains to observe that 
Ao-quantifiers are adequately represented by quantifiers over T, since by definition 
X e T/y if and only if X = T/x for some x ^ y. □ 

Lemma 6.43. V(Set) satisfies AQ-separation. 

Proof. Just like ILemma 6.361 but using ipf'° instead of f^, and the Ao-separation 
property of [Proposition 3. 17| instead of the separation axiom. □ 

Lemma 6.44. V(Set) satisfies foundation. 

Proof. For any Ao-formula ip in V(Set) and any well-founded APG X € V(Set), 
we can form {x £ X \ (p{X/x) } using Ao-separation, since ip{X/x) = (p'^"{x). The 
hypothesis on ip implies that this is an inductive subset of X, hence all of it. This 
implies the desired conclusion, since for every well-founded extcnsional APG Y there 
is another one X with Y e X. □ 

Lemma 6.45. //Set is Boolean, then V(Set) satisfies Aq- classical logic. 

Proof. For any Ao-formula if in V(Set), Ao-separation supplies a subset { | </? } C 
{0}. If this is complemented in Set, then we must have V ^ip. □ 

This completes the proof of lThcorcm 6.161 

Of course, it is natural to ask to what extent the constructions V(— ) and Selt(— ) 
are inverse. We have already seen the canonical inclusion S£lt(V(Set)) ^ Set, and 
the following is easy to verify. 

Lemma 6.46. The inclusion Se[t(V(Set)) ^ Set is an equivalence if and only if 
every object of Set can be embedded into some well-founded extensional graph. □ 

I propose to call this property of Set the axiom of well-founded materialization. 
(Other axioms of materialization would arise from using various kinds of non- well- 
founded graphs.) 

Note that well-founded materialization follows from the axiom of choice, since 
then every object can be well-ordered and thus given the structure of an APG 
representing a von Neumann ordinal. We remark in passing that this implies that 
"all replacement schemata for ETCS are equivalent." 

Proposition 6.47. Let 7i and T2 be axiom schemata for structural set theory such 

that for each i — 1,2, 

(i) ifV satisfies ZFC, then S£l(V) satisfies %, and 
(ii) if Set satisfies ETCS+Ti, then S€lt(V) satisfies ZFC. 

Then Ti and T2 are equivalent over ETCS. 



Proof Since ETCS includes AC, for any model of ETCS we have Set ~ Se[t(V(Set)). 
Thus, if Set ^ 7i, then by (ii) we have Se[t(V) t= ZFC, hence by (i) we have 
Set — Se[t(V(Set)) ^ The converse is the same. □ 
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We have seen that our axioms of conection and replacement from Sj5] satisfy (i) 



and (ii) so over ETCS they are equivalent to any other such schema. This includes 
the replacement axiom of McLarty [McL04', the axiom CRS of Cole |Col73] . the 
axiom RepT of Osius [Osi74) , and the reflection axiom of Lawvere [LawOSl Remark 
12]. However, our axioms seem to be more appropriate in an intuitionistic context. 
Returning to the material-structural comparison, on the other side we have: 

Proposition 6.48. //V satisfies the core axioms of material set theory along with 
infinity, exponentials, foundation, and transitive closures, then there is a canon- 
ical embedding V — s- V(S(e11(V)). This map is an isomorphism if and only if V 
additionally satisfies Mostowski 's principle. 

Proof. By assumption, any x 6 V has a transitive closure TC{x), which is a well- 
founded extensional graph. If we define Y = TC(a;) -I- 1, with -< induced by € on 
TC(a;) and with z ★ for all z G x, then F is a well-founded extensional APG, i.e. 
an object of V(Se[t(V)). This construction gives a map V — V(Se[t(V)), and it is 
straightforward to verify that it preserves and reflects membership and equality. 

Now if this embedding is an isomorphism, then clearly V must satisfy Mostowski's 
principle, since V(Se[t(V)) does so. Conversely, if V satisfies Mostowski's principle, 
then every X e V(Selt(V)) is isomorphic in V to a transitive set, and therefore 
equal in V(Selt(V)) to something in the image of the embedding. □ 

Remark 6.49. The theory Mo of [MatOlj consists of the core axioms together with 
power sets and full classical logic. If V (= Mq, then V(S£[!;(V)) is precisely the 
model Wi constructed in [MatOli §2], which satisfies Mq plus regularity, transitive 
closures, and Mostowski's principle, and inherits infinity and choice from V. (In 
the presence of classical logic and power sets, the axiom of infinity is unnecessary 
for the construction V(-).) In particular, if V N ZBQC, then V(S€lt(V)) N MOST, 
while V(Selt(V)) V if we aheady had V 1= MOST. 

So far we have concentrated on building models of pure sets only. However, we 
can also allow an arbitrary set of atoms: we fix some A e Set and modify our 
definitions as follows. (The definitions not listed below need no modification.) 

• An ^-graph is a graph X together with a partial function £: X ^ A, such that 
dom(£) is a complemented subobject of X, and if a; ^ y then y ^ dom(£). 

• Isomorphisms between A-graphs are, of course, required to preserve the labeling 
functions £. 

• An A-graph is A-extensional if 

(i) £ is injective on its domain, and 

(ii) for any x,y ^ dom(£), ifz^x^^z^y for all z then x = y. 

• An A-simulation between A-graphs is a simulation f : X ^ Y such that for 
any x G X, ii either £{x) or £{f{x)) is defined, then both are, and they are equal. 

Note that if an A-graph X is an APG and ★ G dom{£), then X can have no nodes 
other than the root, so X is simply an element of A. Thus, accessible pointed 
A-graphs model atoms themselves in addition to sets that can contain atoms. 

It is straightforward to verify that all the above lemmas, and the main theorem, 
still hold when extensional well-founded AFGs are replaced by A-extensional well- 
founded accessible pointed A-graphs. The resulting material set theories, of course, 
satisfy the modified axioms for theories with atoms listed at the end of ij2] 
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7. The stack semantics 

We now introduce the stack semantics of a Heyting pretopos S, no longer 
assumed to be well-pointed. (In fact, we will work most of the time with a positive 
Heyting category, although a few facts require exactness.) In the introduction, we 
described two approaches to this semantics: first, as a direct generalization of the 
usual Kripke-Joyal semantics, and second, as a fragment of the internal logic of the 
category of sheaves or stacks. In this section we will take the first, more explicit, 
viewpoint; in ijlOl we will show how it agrees with the second. 

Recall that our goal is to embed the usual internal type theory in a structural 
set theory, along the lines of lLemma 3.151 The interpretation of the internal type 
theory is usually defined by constructing, for any formula with (say) one free 
variable x of type A (an object of S), a subobject A which we think of 

as the subset { a; G A | ip{x) }. This approach is very powerful and flexible — for 
instance, it generalizes to the internal logic of any fibered poset — but it seems 
inadequate to deal directly with unbounded quantifiers. 

Thus, we start instead with the Kripke-Joyal semantics (see e.g. [MLM94| VI.6]), 
according to which \ip\ ^ A can be defined indirectly by characterizing the sub- 
presheaf S(— ,|(/j]) ^ S(— ,A), i.e. characterizing which maps U A factor 
through fipj. The usual construction of then becomes a proof that this sub- 
functor is representable. The stack semantics consists of defining a sub-presheaf 
"S(— , Iv?])" for any formula ip in a similar way, though it will not in general be 
representable. (This also makes the connection with Sh(S) clear, since this sub- 
presheaf is in fact a sub-sheaf and thus a genuine subobject in Sh(S).) 

If U is an object of S and </? is a formula of category theory with parameters in 
S/U, we say that p is a formula over U. Note that a formula over 1 is the same 
as a formula in S itself. We can think of a formula over U as an assertion taking 
place in each fiber. If moreover V --^ U is any map, its pullback p* 93 is a formula 
over V obtained by replacing each parameter of ip by its pullback along p. 

Remark 7.1. Since pullbacks are only defined up to isomorphism, the notation p*(y9 
is, strictly speaking, ambiguous. However, by isomorphism- invariance (Lemmas l3.2l 
and l7.ijl^I)] ), the particular choices made are irrelevant. Moreover, since only a finite 
number of choices are ever needed for any particular formula, making such choices 
requires no axiom of choice in the metatheory. 

Definition 7.2 (The stack semantics). Let S be a positive Heyting category, and 
let (yj be a sentence over U in S. The relation U \\- ip is defined recursively as follows. 

(lha) C/ !h (/ = g) iff in fact f = g. 
(IhT) C/ Ih T always. 
(lh_L) J7 Ih _L iff [/ is an initial object. 
(IhA) {ipA xp) iff [/ Ih and U Ih ?/>• 

(IhV) U {ip\/ Ip) iS U ^ V UW, where V >^ U and W >^ U are subobjects 

such that V Ih i*(p and W Ih j*ip. 
(Ih=>) C/ Ih ((^ ^ V) iff for anyV-^U such that V Ih p*p, also V Ih 
(Ih^) U Ih -np iff Uh{p^ ±). 

p 

(lh3o) U Ih {3X)p{X) iff there is a regular epimorphism V — » U and an object 
A e S/V such that V Ih p*ipiA). 
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(ll-3i) Similarly, U Ih (3/ : A — > B)ip{f) iff there is a regular epimorphism V — » U 
and an arrow g: p* A p*B in S/V such that V Ih p*(p{g). 

(IhVo) U Ih {VX)ip{X) iff for any F ^ ?7 and any object A e S/V, we have 
V IhpXA). 

(IhVi) Similarly, C/ Ih (V/: A B)ip{f), where A and B are objects of S/U, iff for 

any V — ^ C/ and any arrow p*A p*B in S/V, we have V Ih p*^p{i)- 
If is a formula over 1 (i.e. a formula in S), we say is valid if 1 Ih if. 

We occasionally write [/ Ihs if we wish to emphasize the category S. We may 
also write F Ih lyj instead oiV \\- p*if \i the map p is obvious from context. 
We now prove a couple of basic lemmas about the stack semantics. 

Lemma 7.3. Let ip be a sentence over U in a positive Heyting category S. 

(i) If if' is an isomorph of Lp, then U \\- ip' if and only if U Ih ip. 

(ii) If U Ih ip, then for any V — ^ U we have V Ih p*ip. 

p 

(Hi) If V — » U is a regular epimorphism and V h p*ip, then U h if. 
(iv) IfU is initial, then U \h ip for any ip. 
(v) IfU^VUW with Vl^ip and W Ih ip, then U Ih ip. 



Proof. These are all inductions on formulas, (i) is easy, just like ILemma 3.21 and 



(ii) needs only the fact that regular epis and unions are stable under pullback and 



initial objects are strict (that is, any map — ^ is an isomorphism). Strictness of 



initial objects also immediately implies (iv) 



For (iii) T, _L, and A are trivial. Atomic formulas, =>, and V follow from 
pullback-stability of regular epimorphisms. For V, we take images, and for 3, we 
just compose regular epis. 



(v) is only slightly more involved. Once again, T, _L, and A are trivial, while 
atomic formulas, =^>, and V follow from pullback-stability of unions. V is also easy 
since unions distribute over themselves. For 3o, if we have U ~ V U W with 
regular epis V ^ V and W W, and objects X e S/V and Y e S/W such 
that V Ih ip{X) and W Ih ip{Y), then because coproducts are disjoint and stable, 
X + Y e S/{V' + W) pulls back to X and Y over V and W, respectively; thus by 
the inductive hypothesis, V + W Ih ip{X + Y). And V + W' U is regular epic, 
so U Ih {3X)ip{X). The case of 3i is analogous. □ 



We refer to ILemma T.^^fni) (iv) and (v) as descent of forcing. Collectively, 



they say that "forcing descends along finite jointly effective-epimorphic families" 

Lemma 7.4. The usual rules of deduction for intuitionistic logic are sound for Ih. 
In other words, if ip ^ ip is provable and U W if, then also U \\- if^. 

Proof. Straightforward verification; see, for instance, |Joh021 Dl.3.1] for the axioms 
we have to prove. The only slightly nontrivial axioms are the rules for falsity, 
disjunction, and existential quantification. The axiom 

for falsity follows from ILemma 7.>^riv) For the axiom 



[ip^x) =^ ((V' ^ x) ^ {{v V V) x)) 

we must check that if U h {ip ^ x)? U h [ijj ^ x)i and C/ Ih ((/s V V'), then U Ih x- 
But [/ Ih ((/? V Ip) means U ^ V \JW with V h ip and W Ih -0, while the other 
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two hypotheses imply II" X and W \\- x', so U \^ x follows by descent of forcing 
()Lemma 7.t^fv)[ ). Finally, for the axiom 

we must check that if U Ih (VX)(^(X) ^ V) and U Ih {3X)(p{X), then U Ih V- 

But U Ih (3X)iy9(X) means we have a regular epimorphism V — » C/ and A G S/F 
with y II- p*ip{A). The other assumption then implies that V \\- p*ip, so U \\- iJj 
again follows by descent of forcing (jLemma 7.i Jm) I . Quantification over arrows is 



identical. □ 

Now we consider the relationship of the stack semantics to the usual internal 
logic, by way of representing objects. 

Definition 7.5. Let S be a positive Heyting category and (p a sentence in S over U. 
We say that a subobject ^ U represents or classifies ip if for any V U, 

V \\~ p*(p p factors through [i^]. 

Evidently fip^ is unique up to isomorphism, if it exists. As suggested earlier, we 
can then prove that the usual constructions used in the internal logic do produce 
such classifying subobjects. 

Proposition 7.6. Every /S.q- sentence in a positive Heyting category is classified. 

Proof. First note that a Ag-sentence over U can be translated into a Ag-sentence in 
S with one free variable u d U. We interpret parameters in S/U as parameters in S 

by ignoring their structure maps to [/, while for any {X — > U) E S/U we modify 
the Ag-quantifiers (Vx G X)lp and {3x G X)lp to read instead (Vx G X){{fx — 
u) ip) and (3a; G X){{fx — u) A ip). Now we further translate this formula 
along the equivalence of lLemma 3.15l to obtain a formula p{u) in the usual internal 
logic of S, with one free variable u : U . Comparing definitions shows that for any 
p: 1^ —>■[/, we have V Ih p*Lp in the stack semantics exactly when V Ih p{p) in 
the usual Kripke-Joyal semantics. It then follows, by the usual characterization of 
Kripke- Joyal semantics, that the standard representing subobject of p also classifies 
ip in the above sense. □ 

In particular, the usual internal logic of a positive Heyting category is exactly 
the Ao-fragment of the stack semantics. More precisely: 

Corollary 7.7. A formula in the internal logic of S is valid if and only if its 
translate under the correspondence of lLemma 3.15\ is valid in the stack semantics. 

If S is a Il-pretopos, then classifiers for all arrow-quantifiers can be constructed 
from those for Ag-quantifiers, since morphisms 1 — >■ are the same as morphisms 
X ^ Y . Likewise, if S is a topos, we can classify quantifiers over subobjects. 
However, there is no hope to classify arbitrary object-quantifiers in this way, and 
in general not all sentences will be classified. This suggests the following definition. 

Definition 7.8. A positive Heyting category is autological if all sentences over 
all objects of S are classified. 

In [Theorem 7.221 we will show that S is autological precisely when its stack 
semantics validates the structural axiom of separation from [jH But first, we need to 



STACK SEMANTICS 



41 



investigate more generally how validity in the stack semantics relates to "external" 
properties of S itself. 

Like the ordinary internal logic which it generalizes, validity in the stack seman- 
tics can be interpreted as "local" truth. In particular, for "statements which are 
their own localizations," validity in the stack semantics is equivalent to external 
truth. Chief among "statements which are their own localizations" are assertions 
of pullback- stable universal properties. More generally, by interpreting universal 
properties in the stack semantics we transform them into their "localizations." In 
order to make this precise, we will reuse the notions of context and instantiation 
from the (closely related) discussion of replacement axioms in fj5l 

Theorem 7.9. Let S be a positive Heyting category, let (F, A) be a context in S 
such that A consists only of arrow-variables, and let Lp{T) and ^(F, A) be formulas. 
Then the following are equivalent. 

(i) 1 Ih '"for any A : F such that <p(A), there exists a unique / : A extending A such 
thatV(A/).^ 

(ii) For any U and any A :T in S/U such that U Ih ip{A), there exists a unique 
/ : A m S/U extending A such that U Ih 'il'{A, /). 



Proof. By the forcing interpretations of V and 3, statement (i) is equivalent to 
saying that for any U and any A : T in S/U such that U Ih ip{A), there is a 
regular epi V — » U and an / : A in S/V extending p*A such that V Ih (p{p*A, /), 
and moreover for any W V and h : A in S/W extending q*p*A such that 
W Ih ip{q*p*A, h), we have f^h. 

In particular, / is unique in S/V such that V Ih Lp{p* A^ /), and therefore all the 
arrows that make it up will satisfy the descent conditions over the kernel pair of p. 
Since any Heyting category is a prestack for its coherent topology, / must descend 
to an instantiation g of A extending A over U , and descent of forcing implies that 



U Ih ^p{A, /); this proves (ii) The converse is easy. □ 



The following example will hopefully help clarify in what sense this theorem is 
about puUback-stable universal properties. 

r ^ q 

Example 7.10. Let R ( P > Q be a diagram in S such that qr — qs. Let 

s 

F be the context {X,f: P X), let (p{X,f) assert that fr — fs, let A be the 
context g: Q ^ X extending F, and let il}{X, /, g) assert that gq = /. (Note that R, 
P, Q, r, s, and q are parameters of these contexts.) Then [Theorem T^ FiT becomes 



1 Ih '~q is a coequalizer of r and s"', while (ii) becomes the assertion that q is a 
puUback-stable coequalizer of r and s. 

Generalizing from this example in the evident way, we can interpret ITheorem 7.91 
as saying that 1 Ih '~B has some universal property"' if and only if U*B has the given 
universal property in S/U for any J7 e S. Similarly, for asserting the existence of 
objects with universal properties, we have the following. Note that here we require 
exactness, just as we did for |Proposition STT] 

Theorem 7.11. Let S be a Heyting pretopos, let (F, A) be a context in S, and let 
ip{T) and ip(T, A) be formulas. Then the following are equivalent. 
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(i) 1 Ih '"for any A : T such that (p{A), there exists a B : A extending A such that 
ip{A,B), and any two such B are isomorphic by a unique isomorphism extending 

(ii) For any U and any A : T in S/U such that U Ih f{A), there exists a B : A in 
S/U extending A such that U Ih ipi^^ B), and any two such B are isomorphic 
by a unique isomorphism extending 1^. 

Proof. Just like the proof of ITheorem 7.91 but using the facts that any pretopos is 
a stack for its coherent topology, and that uniqueness of isomorphisms implies that 
they satisfy the cocycle condition. □ 

Following on from [Example 7.10[ we have the following. 

Example 7.12. Let T be the context {R,P,r: R ^ P,s: R ^ P), let = T, let 
A be the context {Q,q: P —¥ Q) extending F, and let ip be the formula '~q is a 
coequalizer of r and s"' considered in [Example 7.10[ Then [Theorem 7. l][(i)[ becomes 



1 Ih ^every parallel pair has a coequalizer"', while (ii) asserts that every slice category 
of S has pullback-stable coequalizers (for which it suffices that S itself has them) . 

Thus, we can interpret ITheorem 7.11! as saying that 1 Ih '"for all A, there exists 
B with some universal property"' if and only if for any U and any A in S/U, there 
exists B in S/U such that p*{A, B) has the specified universal property in S/V for 
any p: V ^ U . In the future, we will apply these theorems to all sorts of universal 
properties without further comment. 

For statements ip that do not express simple universal properties, however, valid- 
ity in the stack semantics (expressed by 1 Ih 93) and external truth (expressed by 
S N (p) can have quite different meanings. For example, if ip is '"every regular epi 
splits"', then S N 1^ iff S satisfies the external axiom of choice (AC), while 1 Ih iff 
S satisfies the internal axiom of choice (lAC). The most important example of the 
divergence of N and Ih, however, is the following. 

Lemma 7.13. For any positive Heyting category S, we have 1 Ih '"S is constructively 
well-pointed and satisfies collection"'. 

/ 

Proof. We first show that 1 Ih '"S is constructively well-pointed"'. If X — !■ U is in 

S/U, m: A ^ X is monic, and U Ih '"every 1 X factors through A^, then in 

particular the generic element Ax: X — ^ f*X in S/X factors through m; hence 

m is split epic and thus an isomorphism. Thus 1 Ih ^1 is a strong generator"'. Now 

since the initial object is strict, the existence of a map 1 — >■ is the same as saying 

that 1 is an initial object. Then if U Ih ''Ijj is initiaP, U must be initial; hence 

1 Ih '"1 is not initiaP. Similarly, if U Ih — > Ijj is regular epic"', then 1/ — [/ is in 

fact regular epic, and thus (since V has a section over itself) U Ih {3v: 1 — > V)T. 

Finally, if U Ih ^U — VUW^, then U = VUW, and so since V and W have sections 

over themselves, we have U Ih {3v: 1 — > V)T V {3w: 1 W)T. 

We now show 1 Ih '"S satisfies collection^. Suppose that 1 Ih (Vu e U){3X)ip{u, X). 

p 

Then U Ih {3X)(p{A{j , X), so we have a regular epi V — » U and an A G S/V with 
V Ih ip{p,A). Thus, for any W and any W V, we have W Ih ip{pv,v* A), which 
is the desired conclusion. Collection of functions is analogous. □ 

This validates our assertion that the stack semantics of any Heyting pretopos 
models a structural set theory. Therefore, from now on we avail ourselves of 
IConvention 3.141 when speaking in the stack semantics. 
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Remark 7.14. Under the second approach to stack semantics. ILemma 7.13l savs that 
if S is small, any strictification of its self-indexing is well-pointed and satisfies collec- 
tion as an internal category in the topos Sh(S) of sheaves for the coherent topology 
of S. Since Sh(S) is a coherent topos, it has enough points, so this is equivalent to 
saying that each stalk has these properties. This version of ILemma 7. 131 was proven 
in |Awo97j , and we will prove the analogous fact for the 2-category of stacks on S 
in [Shua] : see also flOl 

Remark 7.15. [Theorem 7.111 implies that 1 Ih '"the self-indexing of S is a stack^ is 
true in any Heyting pretopos. Thus, by Propositions 15.2! and 15.71 replacement of 
contexts is also always valid in the stack semantics of a Heyting pretopos. 

Moreover, any additional axiom of structural set theory that is expressible as 
a puUback-stable universal property will be faithfully represented in the stack se- 
mantics. This includes all the structure mentioned in [Theorem 3.51 except for AC 
and full classical logic. In particular, we can say: 

• If S is a Il-pretopos with a nno satisfying the "internal presentation axiom" 
(there are enough internal projectives), then its stack semantics models CETCS. 

• If S is any topos with a nno, then its stack semantics models lETCS. 

Of course. [Lemma 7. 131 also says that the stack semantics of a Heyting pretopos 
is not just any structural set theory, but also satisfies collection. In particular, 
from any constructively well-pointed Heyting pretopos, we can construct another 
one which satisfies collection — albeit in an exotic logic (namely, the stack semantics 
of the original category) . This implies the well-known fact that intuitionistically, 
the addition of collection does not change the consistency strength of a theory. 

Remark 7.16. Since by [Proposition 5. "4} adding collection to full classical logic does 
change the consistency strength, it follows that full classical logic is not in general 
preserved by passage to the stack semantics. It is not hard to show that if the stack 
semantics of S satisfies full classical logic, then S is necessarily autological. 

In fact, well-pointedness and collection are "precisely" the characteristic prop- 
erties of the stack semantics, in the following sense. 

Theorem 7.17. Let S be a positive Heyting category; the following are equivalent, 
(i) S is constructively well-pointed and satisfies collection. 

(a) For any U G S and any sentence Lp over U , we have U \\- tp if and only if 
S N u*ip for all 1 U. 



Proof. First assume (ii) In particular, this means that for any sentence in S we 



have 1 Ih (/? if and only if S N (p. Since the stack semantics is always constructively 



well-pointed and satisfies collection, it follows from (ii) that S is so, proving (i 



Now assume (i) we prove (ii) by structural induction on ip. For an atomic for- 
mula (/ = g) where f,g: X ^ Y in S/U, we can verify that (/ = g) is equivalent to 
(V.X G X){fx = gx), which is a Ao-formula and hence classified by [Proposition 7!6l 
Thus, strong-generation of 1 implies the result for atomic formulas. 

The cases of T and A are obvious, as usual. If U Ih _L, then U is initial, and thus 
(since 1 is nonempty) it has no global elements 1 — > t/; thus S 1= _L for every such 
global element. Conversely, if U has no global elements, then the map — ?7 is a 
bijection on global elements, hence an isomorphism since 1 is a strong generator. 
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If U Ih ((^V?A), then U = \/UVF with V \h (p and Ih ip; hence by the inductive 
hypotheses, S N w*iy9 for all 1 ^ V" and S N w*^' for all 1 ^ W. But since 
1 is indecomposable, every 1 — ^> [/ factors through either V or W, hence either 
S N u*ip or S N u*^jJ, so S N u*{ip V ip). Conversely, suppose S N u*{ip V V') for 
each 1 U, and consider the objects U and U + U over [/, which pull back to 
1 and 1 + 1 along any 1 — ^ U. Applying collection of functions to the statement 

•"either u*ip and 1 — > 1 + 1 is the first injection, or u*ip and 1 — > 1 + 1 is the 

p 

second injection^, we obtain a regular epimorphism V — » U and a suitable map 
V ^ V + V over V. This map decomposes ^ as a coproduct W + X, and by the 
inductive hypothesis we have W Ih p*tp and X Ih p*ip; hence U \\- {cpV ip). 

If U \\- {(fi ^ tp), then for any 1 [/, if S 1= u*ip, then by the inductive 
hypothesis 1 Ih u*ip and so 1 Ih u*ijj, hence S N u*'ijj by the inductive hypothesis. 
Thus S 1= u*{ip ^ %p). Conversely, if S N ip) for aU 1 U, then for 

any V — ^ U with V Ih p*ip, for any 1 — % y we have 1 Ih (j)v)*tp, hence (by the 
inductive hypothesis) S N {pv)*(p, so S 1= {pv)*tp, and thus 1 Ih {pv)*tp. By the 
inductive hypothesis, we have V Ih p*'4>] hence C/ Ih ((^ ip). 

p 

If U Ih {3X)ip{X) , then we have a regular epimorphism V — » U and an ^ G S/y 

with V Ih <(5(^). But for any 1 [/, by projectivity of 1 there is a 1 V with 

pv = u, and 1 Ih hence S N (pw)Xw*A), and thus S N (3X)(p?;)*(^(X). 

Conversely, if S N {3X)u* Lp{X) for each 1 U , then by collection of sets, there 

p 

exists a regular epimorphism V — » U and an ^ e S/y such that S N (pti)*(/7(7j* A) 
for all 1 — ^ y, whence V Ih by the inductive hypothesis, and so [/ Ih 

{3X)ip{X) . Existential quantification of morphisms is analogous. 

Finally, if U Ih (VX)(^(X), then for any 1 [/ and A e S we have 1 Ih 
u*Lp{A), hence S N u*tp{A) by the inductive hypothesis, and so S N (yX)u*'p{X). 
Conversely, if S N {^X)u*ip{X) for all l-^U, then for (myV -^U and B G S/y, 
we have S N {pv)*^p{v*B) for any 1 y, hence y Ih p*tp{B) by the inductive 
hypothesis; hence U Ih (VX)<^(X). □ 

Corollary 7.18. The theory of a constructively well-pointed Heyting pretopos sat- 
isfying collection is complete for stack semantics over Heyting pretoposes. More 
precisely, if a statement is valid in the stack semantics of any Heyting pretopos (in 
any intuitionistic metatheory), then it can he proved from the axioms of a construc- 
tively well-pointed Heyting pretopos satisfying collection. 

Proof. By standard completeness theorems for intuitionistic logic, it suffices to show 
that if 1 Ihs for any Heyting pretopos S (in any intuitionistic metatheory), then 
Set 1= if for any constructively well-pointed Heyting pretopos Set that satisfies 
collection. However, for any such Set. IThcorem 7. 171 implies that Set N (/? if and 
only if 1 Ihset and the latter is true by assumption. □ 

We now turn to our promised characterization of the axiom of separation in the 
stack semantics. First we need to know that the stack semantics is "local" and 
"idempotent" . 

Lemma 7.19. For any V --^ U and any sentence tp over V in S, we have V Ihg f 
if and only if (V A U) \\^s/u 'P- 
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Proof. Straightforward from the definition, since unions and regular epis in S/U 
are created in S. □ 

Lemma 7.20. For any sentence over V and any V — ^ U , we have U Ih '~V Ih ip~' 
if and only if V Ih ip. 

Proof. By ILemma 7.19| it suffices to assume that U = 1. And since the stack 
semantics of S satisfies cohection, bv lThcorcni 7. 17] we have 

(7.21) 1 Ih Ih if if and only if v*ip holds for all 1 ^ 

In the "only if" direction, (|7.2ip says that if W is such that for any Z — ^ W and 
Z we have Z Ih v*ip, then W Ih W*{'~V Ih ip^), i.e. W Ih ^W*V Ih W*p^. In 

particular, for W — 1, this says that if for any Z V we have Z Ih v*ip, then 1 Ih 
'~V Ih But this hypothesis is satisfied as soon as V Ih ip, so V \^ p implies 1 Ih 
Ih p>^. 

In the "if" direction, ([7:2T|) says that for any W if Ih ^W*V Ih W*p'^, 

then Ih In particular, ior W — V and w ~ ly, it says that if V Ih 

Ih V*p'^, then Ih 93. But if 1 Ih Ih (p^, then also Ih ^V*V Ih F*^^^ by 
puUback, so 1 Ih '~V Ih ip~' implies V \\~ p} a,s desired. □ 

Recall that we define S to be autological if all sentences over all objects of S are 
classified in the sense of IDcfinition 7.51 

Theorem 7.22. Let S be a Heyting pretopos; the following are equivalent, 
(i) S is autological. 
(ii) 1 Ih '"S is autologicaP 
(Hi) 1 Ih '"S satisfies the axiom of separation"'. 

(iv) (If S is constructively well-pointed) S satisfies separation and collection. 



Proof. ILemma 7.201 implies that autology is a pullback-stable universal property, 



so ITheorem 7.111 implies that (i) i=; (ii) And by [Theorem 7.17| the stack seman- 



tics is always constructively well-pointed and satisfies collection, so if we show 



that (i) ^ (iv) then internalizing the same argument will show (ii) ^ (iii) 

Suppose S is constructively well-pointed and autological; we show it satisfies 
[Theorem 7.11 Jn) Note that the inductive proof of l7.1'<[l^i)"| => (ii) only used collection 



in two cases, V and 3, and only in the (N) (Ih) direction. Thus it will suffice to 
prove [7Jj:ii)l for formulas of the form {p V i'), {3X)p{X), or {3f : X ^ Y)p{f), 
in each case assuming inductively that 17. 17[(ii)| holds for the constituent formulas. 

Note first that all of these statements are obvious ii U = 1. In the case of V, if 
S 1= ((/? V Tp), then S 1= </? or S N i/i, whence by induction 1 Ih (/j or 1 Ih -0, and thus 
1 Ih ((^ V ■0) via one of the decompositions l = lUOorl = OUl. Similarly, in the 
second case, if S 1= (3X)p(X), then there is some ^ e S with S N p}{A), whence 
by induction 1 Ih p{A), and so 1 Ih {3X)p{X) via the cover 1^1. Quantification 
over arrows is identical. 

Now if X is one of the formulas in question over a general U, by autology we 
can form fxl ^ U. By hypothesis, for any 1 U we have S N u*x, so the 
above remark shows that 1 Ih u*x, whence u factors through fxl- But 1 is a strong 
generator, so |xl is all of U and thus U Ih x, as desired. 

Thus, bv ITheorem 7.17] S satisfies collection, so it remains to prove separation. 
Suppose given U and p{u), and let ijj = U*p{Aij). Then ip is a sentence over U 
such that tt*0 is equivalent to p{u) for any 1 — ^ U. Now consider ftpj. Then for 
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any 1 — ^> U, bv lTheorem 7.17] S 1= ip{u) is equivalent to 1 Ih (p{u), and thus to 
1 Ih u*'ip, which is true iff u factors through |?/']; thus li/'l satisfies the conclusion of 



the separation axiom. Thus we have (i) =^ (iv) 



Now assume S is well-pointed and satisfies separation and collection. For any 
sentence ip over U, we apply separation to find a subobject S >—> U such that 
1 U factors through S if and only if S N u*ip. Bv lTheorem 7.17[ S Ih (p. And if 
V — > U is such that V Ih p*ip, then for any 1 V, pv factors through S, which 
(since S is well-pointed) implies that V factors through S. Thus, S" = |(^|, so S is 
autological. □ 



In particular, the implication (iv) (i) of lTheorem 7.221 shows that if V satisfies 



IZF, then Se[b(V) is autological, giving us our first examples of autological topoi. 
We now present a quick proof that any complete topos over IZF (including any 
Grothendieck topos) is autological. 

Fix a model V of IZF. As usual in material set theory, by a large category we 
mean a category whose objects and arrows form proper classes in the sense of V, 
i.e. consist of the sets in V satisfying some first-order formulas. Recall that a topos 
is well-powered if and only if it is locally small, and that if it is complete it is also 
cocomplete. Note that any cocomplete topos also has a nno, namely the countable 
copower of 1. The examples of most interest are of course Grothendieck toposes, 
i.e. categories of sheaves on a small site. 

Lemma 7.23. // S is a complete and well-powered topos over a model of IZF and 
U = Uie/ in S with Vi Ih (p for all i ^ I, then U Ih (p. 

Proof. This is, of course, an extension of lLemma 7.t^(v)] to the infinitary case, but 
the proof requires the use of collection in V. The cases of atomic formulas, T, ±, 
and A are again easy, while V follows from distributivity of unions over themselves, 
and ^ and V follow from pullback-stability of unions. 

For 3, if we have Vi Ih {3X)(p{X) for all i & I, then for each i there is an 
epimorphism W ^ V and a,n A € S/W such that W Ih ip{A). By collection in 
V, we have a set Q such that for every i e / there is a quadruple {i, W,p, A) e Q 
such that p: W ~» Vi is an epimorphism, A G S/W, and W Ih ip{A). Let B = 
]l{i,w,p,A)&Q^ ^^'^ ^ ^ 11(4,1^,^.^)6 Q which exist since S is cocomplete. We 
then have an induced epimorphism q: Z ^ U, and since Z = (Jj-^ a)£Q ^ ^'^'^ 
B pulls back over each W to the corresponding A, the inductive hypothesis implies 
that Z Ih ip{B). Therefore, U Ih {3X)(p{X). Existential quantification over arrows 
is analogous. □ 

Theorem 7.24. Any complete and well-powered topos over a model of IZF is auto- 
logical. 

Proof. Let S be such a topos and ip a sentence over U in S. Using separation in 
V and well-poweredness of S, let K he a set of subobjects of U representing each 
isomorphism class V ^ U such that V Ih ip. Since S is complete, K has a union; 
call it S. Bv lLemma 7.231 S' Ih 1^9. And given any W such that W Ih ip, if R 

is the image of p, then R\\- ip, so R = V for some V G K; hence R C S and thus p 
factors through S. Thus, S classifies ip, so S is autological. □ 

Remark 7.25. This implies that in a Grothendieck topos of sheaves on some site, 
the definition of the stack semantics can be rephrased in terms of a forcing relation 
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defined only over the site, just as for the usual internal logic. We omit the proof, 
which is very much like those of Theorems 17.171 and 110.81 

We will see another way of proving autology in tjlOl the category of small ob- 
jects in any category of classes which satisfies separation is autological. In jShub] 
we will prove directly that autology is preserved by many other topos-theoretic 
constructions. 

Remark 7.26. We have not mentioned the interpretation of fullness, induction, or 
well-founded induction in the stack semantics. Since these do not express simple 
universal properties, their stack-semantics versions are not generally equivalent to 
their "external" versions. One can, of course, write out explicitly in terms of S 
what each of these axioms means in the stack semantics, and the result will be the 
appropriate version of that axiom for a non-well-pointed category. For example, 
the assertion that 1 Ih '"S satisfies fullness"' is equivalent to the categorical version 
of fullness given in jvdBDMOTl lvdBM07| (minus their 'smallness' conditions). 

8. Material set theories in the stack semantics 

We can now combine §!j6]and[7]in the expected way: from any Heyting pretopos 
S, we obtain an interpretation of material set theory by interpreting the theory of 
fj6] in the stack semantics of S. In particular, we can construct interpretations of 
material set theory by starting with a model V, passing to the category Se[t(V), 
performing some category-theoretic construction on Selt(V) (which generally de- 
stroys well-pointedness), then constructing the model of f}6]in the stack semantics 
of the resulting category. 

There are several important questions to ask about this construction. The first 
is, which of the relevant category-theoretic properties of Selt(V) are preserved by 
the constructions in question, and which others can be "forced" to hold or fail by 
a clever choice of such a construction? To study this in generality is not our aim 
in this paper, but we remark briefiy on what is known. 

(i) The most-studied case is that of elementary topoi, which are well-known to be 
preserved by all sorts of constructions, such as sheaves (on internal sites), coal- 
gebras for left-exact comonads, Artin gluing, realizability, and filterquotients. 
Natural numbers objects are also usually preserved. 

(ii) Realizability and sheaf constructions on Il-pretoposes (often also satisfying 
some additional axioms, such as fullness) are studied in |MP00l[MP021lvdB05a[ 
IAGLW091 l^dBOSbl lvdBM07l IvdBMOSl lvdBM09| . among other places (see 
also [KST\ ). 

(iii) Of course, Booleanness and the axiom of choice are not usually preserved by 
any of these constructions. 

(iv) On the other hand, we have seen that collection is always satisfied in the stack 
semantics. 

(v) We will prove in piub] that the axiom of separation, in its stack-semantics 
form (i.e. autology as defined in fJT]) is also preserved by the constructions of 
sheaves, coalgebras, gluing, realizability, and filterquotients. 

(vi) We are not aware of any results regarding the preservation of full induction 
or well-founded induction. 

The second important question to ask is, how does this approach compare to 
existing category-theoretic constructions of interpretations of material set theory? 
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As mentioned in the introduction, such interpretations fall into two groups: the 
older approach of Fourman |Fou80j and Hayashi |Hay81| , and the newer approach 
of algebraic set theory begun by Joyal and Moerdijk jJM95| . The next two sections 
are devoted to comparing our models with these; under general hypotheses they 
turn out to be equivalent. 

The third important question to ask is, how does this approach compare with 
well-known constructions of models that remain entirely within the world of mate- 
rial set theory? We will not study this question here, but a partial answer to it can 
be extracted from our answers to the second question. 

For instance, in j3S89, B S92 it is shown, using a construction of Freyd |Fre87| . 
that the Fourman-Hayashi interpretation in any Boolean Grothendieck topos (de- 
fined over a model of ZFC) can be identified with a certain symmetric submodel of a 
Boolean-valued model of ZF. (Fourman [Fou80| already observed this in particular 
cases.) It then follows that the stack-semantics model in any such Grothendieck 
topos can also be so identified. Hayashi fHay81' also asserted that his interpretation 
in a topos of sheaves on a complete Heyting algebra agrees with the corresponding 
Heyting- valued model of IZF, as in |Gra79| . Since Freyd's construction also applies 
to non-Boolean topoi, it seems likely that the Fourman-Hayashi interpretation in an 
arbitrary Grothendieck topos can similarly be compared to symmetric submodels 
of Heyting- valued models as studied in |TT81) , but to my knowledge this has not 
been written down. Likewise, in jKGvOOSl lvdBM08] it is shown that the model of 
material set theory constructed via algebraic set theory from a realizability topos 
agrees with McCarty's realizability model of IZF jMcc84j . and thus so docs the 
stack-semantics model in a realizability topos. In principle, it should be possible to 
give a direct comparison between stack-semantics models and material-set-theoretic 
models, but we will not do so here. 



9. The cumulative hierarchy in a complete topos 

In this section we will show that in good cases, our interpretation of material set 
theory in the stack semantics is equivalent to the interpretations of Fourman 'Fou80j 
and Hayashi |Hay81| . In fact, Hayashi defines his interpretation by way of a Kripke- 
Joyal semantics, which is thus quite evidently the same as the stack-semantics ap- 
proach. Fourman uses instead representing subobjects, which he can only construct 
in a complete and well-powered topos. Additionally, both focus on a version of the 
"von Neumann hierarchy" constructed internally to the topos, which our approach 
shows to be unnecessary. 

Let us begin by reformulating the stack-semantics interpretation of material set 
theory in terms of elements rather than slice categories. Let S be a topos with 
a NNO, let A be a well-founded extensional graph in S, and let x: U ^ A he a 
morphism. Let x denote the subobject of U*A such that in the internal logic of 
S/U, X contains precisely those y E A which admit a path to x. 

Lemma 9.1. Let x and x be as above, and similarly y.U^A and y. 

(i) U Ih '~x is a well-founded extensional APG^. 

(ii) U \\- {x = y) if and only if x — y. 
(Hi) U \\- (x e y) if and only if x ~< y. 
(iv) If f : A ^ B is a simulation, then t/ Ih (a; = fx). 
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Furthermore, every well-founded extensional APG in S/U is isomorphic to one of 
the form x, for some well-founded extensional graph A in S and some x: U ^ A. 

Proof. Since U* : S — > S/U is a logical functor, and well-foundedness and exten- 
sionality are Ao-properties in a topos, U Ih '~U*A is a well-founded extensional 



graph"'. The proof of (i) is then obvious by arguing internally, while (iv) follows 



from lLemma 6.181 The "if" directions of (ii) and (iii) are easy, while the "only if" 



directions can be shown by well-founded induction. 

Finally, suppose X is a well-founded extensional APG in S/U. Arguing in the 
stack semantics of S, consider X as a graph in S itself and form X -\- I, with -< 
inherited from X and with -< where for each u ^ U, *u denotes the root of the 
fiber u*X. Then X -\- I satisfies the hypotheses of lLemma 6.241 with n = 1; let A 
be its extensional quotient. The section U ^ X (which equips X with its root, as 
an APG in S/U) induces a map x: U ^ A and it is easy to verify that X ^x. □ 

Remark 9.2. Since isomorphisms between well-founded extensional graphs are unique 
when they exist, C/ Ih (x = y) if and only if in fact x = y in S/U, and similarly 
U \\- {x e y) if and only if there exists a z : U -^y such that x = y/z in S/U . 



Remark 9.3. Combining ILemma g.l Tii) with (iv) we see that for x: U ^ A and 



y: U — )■ -B, we have x ^y iS fx ~ gy for some (hence any) well-founded extensional 
graph C with simulations f : A ^ C and g: B ^ C , and similarly for membership. 
Note that for any any such pair A, B there exists such a C with / and g, such as 
the extensional quotient of A + B + 1 . 

Theorem 9.4. The stack semantics interpretation of material set theory in a topos 
can equivalently be described as follows. Instead of well-founded extensional APGs 
in S/U , the parameters at stage U are morphisms x: U A, where A is any well- 
founded extensional graph in S. The forcing semantics of formulas is defined 
inductively by: 

• For x: U ^ A and y: U B, we say U \\- {x ^ y) if fx — gy for some (hence 
any) simulations f : A ^ C and g: B ^ C. 

• Likewise, C/ Ih (x e y) if fx -< gy for f and g as above. 

• The connectives are interpreted in the usual Kripke-Joyal way. 

• We say U Ih {3x)ip{x) if there is an epimorphism V ^ U and an x: V ^ A, for 
some well-founded extensional graph A, such that V Ih ip{x). 

• Likewise, U Ih (yx)ip{x) if V Ih ip{x) for any V ^ U , any well-founded exten- 
sional graph A, and any map x: V ^ A. 

Proof. Straightforward induction on formulas, using iLcmma 9.T1 □ 

This is exactly the interpretation of Hayashi [Hay81| , except that he considers 
only morphisms x: U ^ A where A belongs to some specified class ^ of well- 
founded extensional graphs. Of course, some closure conditions on are then 
necessary to ensure that the axioms of material set theory are satisfied. Hayashi 
assumes that: 

• For any A,B^'^ there is a C € with simulations A ^ C and B ^ C, and 

• For any A ^ there is a B G with a simulation PA ^ B. 

Here PA is the power-object of A, equipped with the well-founded extensional 
relation -< defined internally as follows: for subsets H, K C A, we have H ^ K 
iff there exists x £ K such that H — {y \ y ^ x}. Hayashi calls a satisfying 
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these conditions a pre-universe, and proves that the above semantics valued in 
any pre-universe vahdates the core axioms together with power sets, foundation, 
and transitive closures, plus infinity if there is a NNO, and Ao-classical logic if the 
topos is Boolean. We thus record: 

Theorem 9.5. Let S be a topos and let '% he the maximal pre-universe consisting of 
all well-founded extensional graphs. Then the interpretation of material set theory 
in the stack semantics ofS is identical to Hayashi's interpretation valued in'^ . □ 

Hayashi also defines a universe to be a pre-universe such that 

• For any (small) set S' C there is a S e ^ such that for all A € 5 there exists 

a simulation A ^ B. 

Of course, this is no longer an elementary property; it only makes sense when work- 
ing in some ambient set theory. Note that the class of all well-founded extensional 
graphs need not, in general, be a universe. It is a universe, however, if S is co- 
complete relative to the external set theory, since then B can be obtained as the 
extensional quotient of U^ieS ^ + 1- 

Hayashi proves that the axiom of collection is satisfied if S is well-powered and 
'^^ is a universe. Our approach via the stack semantics shows that in fact, these 
hypotheses are unnecessary: the axiom of collection is always satisfied, at least for 
the maximal prc-universc!. Hayashi also claims that the axiom of separation is valid 
as soon as the subobject lattices of S are complete Heyting algebras, even if is 
only a pre-universe, but I don't think this can be correct, since it would imply the 
relative consistency of collection assuming separation. 

The one remaining difference between Hayashi's approach and ours is that rather 
than the "maximal" pre-universe consisting of all well-founded extensional graphs, 
he is more interested in the "minimal" ones obtained by transfinitcly iterating the 
power set operation, mimicking the construction of the von Neumann hierarchy in 
material set theory. This is also the approach taken by Fourman. 

In order to make sense of this transfinite iteration, we of course need an ex- 
ternal set theory containing ordinals along which we can perform induction. For 
convenience and familiarity, we take this to be a material set theory. Thus, for 
the rest of this section, let V be a model of IZF, with Set = Se[t(V) its category 
of sets. (Fourman and Hayashi assumed the metatheory to be ZFC, but this is 
unnecessary.) 

Lot S be a complete and well-powered topos over V. We will describe the 
cumulative hierarchy in S, as constructed by Fourman and Hayashi. Recall that a 
(von Neumann) ordinal in V is a transitive set on which e is a transitive relation 
(it is automatically well-founded, by the axiom of foundation). Since set-induction 
is valid in IZF, we can construct objects of S by transfinite recursion on ordinals. 
Thus we can inductively define a well-founded extensional graph Va for each ordinal 
a of V such that Va is the extensional quotient of IJ^<„ PVp. (The well-founded 
relation on PVg is defined as above, by setting H ~< K if there exists a.n x & K 
such that H = {y \ y -< x}.) 

Remark 9.6. Fourman and Hayashi defined the hierarchy Va in a more traditional 
way, by conditioning on whether a is zero, a successor, or a limit: 



Vo = Va+i = PVa Va = colim^<a Vff (a a limit) 
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Intuitionistically, this classification of ordinals is no longer valid. We could still try 
to define Va = colini^<ct PVg, but since intuitionistic ordinals are not necessarily 
linearly ordered, in general this colimit need not be extensional. However, in the 
classical case, all three definitions are equivalent. 

Evidently, the class {Va} is a universe in S, in Hayashi's sense. Thus, it induces 
a class of well-founded extensional APGs in all slices of S, namely those of the form 
X for some x: U ^ Va- It is natural to ask whether this includes all well-founded 
extensional apgs, and thus whether Hayashi's interpretation valued in ^ = {Va} 
is the same as the stack-semantics interpretation. The answer is yes. 

Lemma 9.7. In any complete and well-powered topos S, every (internally) well- 
founded extensional APG in S/U is of the form x for some ordinal a and some 
x:U ^ Va- 

Proof. Since every slice topos of a complete and well-powered topos is also such, 
and puUback functors U* preserve the construction of the Va hierarchy, we may 
assume that U = 1. Thus, let X be a well-founded extensional APG in S; the proof 
is a modified version of the standard recursion theorem for well-founded relations. 

For a fixed ordinal a, define an a-attempt to be a partial function X ^ Va which 
is a simulation and whose domain is an initial segment of X . Using extensionality 
of Va, we can prove by induction on X in the internal logic of S that any two 
a-attcmpts agree on their common domain, and that the union of any family of a- 
attempts is an a-attempt. Therefore, there is a unique largest a-attempt fa - X ^ 
Va- Furthermore, for any (3 > a there is a unique simulation i^: Va ^ Vp, and we 
must have i^/a = fp- 

Wc now show that there exists an a such that fa is defined on all of X. Consider 
the set D of subobjects S ^ X such that S is the domain of fa for some a; this 
exists since S is well-powered and V satisfies separation. By collection in V, there 
is a set A of ordinals such that for any S <E D, S = dom(/Q,) for some a G A. 

Let P = [Ja£A ^^'^ 1 ~ P'^'i claim that f^ is a total function. Let be its 
domain. First, note that by the construction of A, there exists an a € ^ such that 
S-y is the domain of fa- Since the domains of /„ are increasing in a, it follows that 

is the domain of fp as well. 

We will prove that is an inductive subset of X, and hence must be all of X. 
Applying the Kripke- Joyal semantics, suppose given some U and some q: U ^ X 
such that for any p: U' ^ U and any q' : U' ^ X such that q' ~< qp, q' factors 
through S-^i ; we must show that q factors through . 

Let T C U* X he the subset defined in the internal logic hy {x & X \ x ~< q}. 
Then by assumption, T factors through U*S-y and therefore the domain of U* fp 
contains T. Then T is classified by a map t: U ^ PX. Now the partial function 
fp determines a map Pfp : PX PVp by taking images, so by composition we 
have a map Pfp ot: U ^ PVp- But PVp = V^, so we have a map r: U ^ V-y- 

Let J7 C X be the image of g: U ^ X. We can prove in the internal logic that if 
q{u) = q{u') for some u,u' S J7, then r{u) = r{u')\ hence r descends to r: ?7 — > V^. 
We can also show, again internally, that if a; G S*-,, and x — q{u), then r{x) — f-yix), 
since both are equal to { f0{y) \ y -< x}. Therefore, if we let S = S^UU, then f^ 
and r induce a map g: S ^ V^ . Finally, we can show that g is a simulation, hence 
its domain is a subset of S-y] thus U C S^, i.e. q factors through S-y- Hence S-y is 
inductive, and thus all of X, so is a total function. □ 
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Therefore, we have: 

Theorem 9.8. Let S be a complete and well-powered topos, and let ^ he the above 
von Neumann universe in S. Then the interpretation of material set theory in the 
stack semantics ofS is identical to Hayashi's interpretation valued in . □ 

Finally, we relate this to Fourman's approach |Fou80| . Instead of a forcing 
semantics, he works with representing subobjects. Thus, we still consider the pa- 
rameters to be morphisms x: V A for some well-founded extensional graph A in 
a pre-uni verse but now instead of a forcing relation we define, for each formula 
Lp at stage C/, a subobject |(/3| ^ [/, as follows. 

• \i x: \J ^ A and y: U B, then fx = y^ is the equalizer of fx and gy where 
f : A ^ C and g: B ^ C are a pair of simulations. 

• Similarly, \x G y\ is the puUback of along {fx,gy). 

• The connectives _L, T, A, V, and -> are interpreted using the Heyting algebra 
connectives in Sub(f7), as usual. 

• Given a formula ^p{x) at stage U with one free variable x, for each well-founded 
extensional graph A consider the image of 

y{^2)l y-^UxA^U. 

This is a subobject of U, call it l{3x G A)(p{x)}j. Since S is well-powered, we can 
apply separation in V to obtain the set of all subobjects of U which are of the 
form l{3x € A)ip{x)l for some A e Since S is cocomplete, we can then take 
the union of this set; call it |(3a;)(^(a;)]. 

• Universal quantification is similar, using the dual image V^n |'/3(7r2)] instead of 
the image 3^^ |(^(7r2)], and an intersection instead of a union. 

These subobjects are essentially the same as those defined by Fourman, although 
he also considered only the von Neumann universe. Thus it remains only to check 
that they do, in fact, represent the forcing relation defined by Hayashi. 

Lemma 9.9. Let S be a complete and well-powered topos and a pre-universe. 
Then for any formula tp at stage U and any map W U, we have W \\- if in 
Hayashi's sense if and only if p factors through lipj in Fourman's sense. 

Proof. Since S is autological bv lTheorem 7.24[ the forcing relation of Hayashi is rep- 
resentable. Thus, it remains only to check that the subobjects defined by Fourman 
are the same as those produced by autology. This is evident for atomic formulas 
and connectives, so we consider only the quantifiers. 

In Fourman's construction of |(3a;)(/7(a;)]], it is clear that |(3x € A)(f{x)}j Ih 
{3x)(p{x) for each A, so bv lLemma 7.231 we also have |(3a;)(/5(a;)] Ih {3x)ip{x). On 
the other hand, given W ^ U such that W Ih (3x)(p{x), we have an epimorphism 
Z ^ W and a map x: Z ^ A, for some A G such that Z Ih (p(x). Thus, 
Z ^ U X A factors through |(jo(7r2)], so W ^ U factors through |(3a; g A)(p{x)l, 
and hence also through |(3a;)93(a:)]|. Thus, Fourman's subobject |(3a:)(/9(a:)] is in 
fact a representing object for (3x)ip{x). 

Universal quantification is even easier. If W Ih {yx)ip{x), then for any A e 
p: W U must factor through |(Va; S A)(f{x)}, whence it factors through their 
intersection |(Vx)(/5(a;)]. Conversely, it suffices to show that |(Va::)v5(a;)] Ih {Vx)ip{x), 
but this follows since by definition, we have |(Va::)(/5(a;)] Ih (Vx G A)ip{x) for any 

A e ^. □ 
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Theorem 9.10. Let S be a complete and well-powered topos, and let be the 

above von Neumann universe. Then the interpretation of material set theory in the 
stack semantics of S is identical to Fourman's interpretation valued in . □ 

As remarked previously, it follows from known facts about the Fourman-Hayashi 
interpretation that the stack-semantics interpretation in Grothendieck toposes, such 
as sheaves on a locale or continuous group actions, can also be identified with 
the logic of standard material-set-theoretic constructions, such as Boolean- and 
Heyting- valued, permutation, and symmetric models. See jFouSOl |BS89[ IBS92] . 



10. Categories of classes 

We now turn to a comparison between the stack semantics and the methods of 
algebraic set theory, a field which was begun by |JM95| and has been carried forward 
by many others; see |ASTj for a number of references. The idea of algebraic set 
theory is to consider, rather than a category whose objects represent sets, a larger 
category whose objects represent classes, equipped with a "notion of smallness" 
specifying which objects (and more generally which families) should be regarded 
as sets. In particular, we require that there is a "class of all sets." We can then 
interpret "unbounded" quantifiers over all sets as bounded quantifiers in the internal 
logic of the category of classes. 

There is not yet a universally accepted set of axioms for a category of classes, so 
we will at first restrict ourselves to a small core set of axioms. 

Definition 10.1. A (representable) notion of smallness on a positive Heyting 
category C consists of a distinguished map E — ^ S. Given tt, a morphism X ^ U 
in C is called small if there exist two puUback squares 




in which U' ^ U is a regular epimorphism. An object X is called small if AT — > 1 
is a small map. 

Observe that a morphism AT — s- [/ is small if and only if U Ih '"there exists an 
X £ S such that X = x*E^ in the stack semantics of C. Wc thus abbreviate this 
statement as '~X is smalP. Note also that a map f : X Y in C/U is small if and 
only if U Ih '"for every y £ Y, the fiber y*X is small"', which is precisely the intended 
intuition. Thus we abbreviate this statement as '"/ is smalP. The possibility of this 
sensible "logical" interpretation depends, of course, on allowing passage to a cover 
in the definition of small maps, since we cannot expect classifying maps of small 
objects to be uniquely defined. 

In the literature, it is more common to consider C as equipped with a class of 
maps called "small" and then assert the existence of a representing map tt as an 
axiom. As observed in [MP02j . however, defining the small maps from tt as above 
has the advantage that it immediately implies a few of the other common axioms 
for small maps, including: 

• Small maps are closed under puUback. 
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• Small maps descend along regular epis, i.e. if the puUback oi J : X ^ U along a 
regular epi V ^ U \s small, so is /. 

• li X U and Y are small maps, then so is X + y — > C/ + y. 

Let S be the full subcategory of C determined by the small objects; we intend 
to define a translation from the stack semantics of S to the internal logic of C. 
However, for S to have a well-behaved stack semantics, it must be itself a positive 
Heyting category. The following definition is closely related to those commonly 
assumed in the literature, but weaker (and thus more general) than most. 

Definition 10.2. A category of classes is a positive Heyting category equipped 
with a notion of smallness which additionally satisfies the following axioms. 

(i) 1 Ihc '"if X is small, then a map f -.Y ^ X \s small if and only if Y is smalP. 

(ii) 1 Ihc '"the full subcategory of small objects is closed under finite limits, finite 
coproducts, images, and dual images (and is therefore itself a positive Heyting 
category)^. 

(iii) Every small map is exponentiable. 

We have stated the first two conditions in terms of the stack semantics, since we 
believe it makes their real meaning clearer. Of course, if we work out what they 
mean explicitly in terms of C, we see that they reduce to some well-known axioms 
for categories of classes. Specifically, the first is equivalent to: 

• if (7 is small, then g f is small if and only if / is small. 

Assuming this (and the representable definition of small maps as above) , the second 
is equivalent to: 

• For any [/, the full subcategory of C/U determined by the small maps is a 
positive Heyting category, and the inclusion functor preserves all the structure. 

More explicitly, this is equivalent to the following axioms. 

• All isomorphisms are small. 

• and 1 H- 1 are small objects. 

• li g: B ^ C and gf : A ^ C are small, then so is the composite im(/) ^ B ^ 
C. (In particular, this follows if small maps are closed under quotients.) 

• li m: A ^ C is monic and small, and / : C — ^ 13 is small, then V/(A) ^ 13 is 
small. 

Finally, if C is exact, then the third condition (exponcntiability of small maps) is 
equivalent to 

• 1 Ih '"every small object is exponentiable"' 

but if C is not exact, then lTheorem T.TTl does not apply, and so this latter property 
does not imply the actual existence of exponentials. 

Remark 10.3. IDefinition lO.z llT is sometimes called the "axiom of replacement," 
but it actually has no connection to our axiom of replacement from ij5l We prefer 
to think of it as saying that the notions of "small family" in S and C agree. 

Now the exponcntiability of the representing map tt: E ^ S implies that it 
determines an internal full subcategory of C, i.e. an internal category whose object of 
objects \s So = S and whose object of morphisms is the exponential Si — {p\EY^^ 
in Sq X Sq. (See |Joh02| B2.3.5] and jJMQSI §1.5].) Regarding this as "the category 
of sets," we can then reason about it in the ordinary internal logic of C. That is, for 
any J7 G S, if is a formula in the language of categories with object-parameters 
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given by maps U ^ So and arrow-parameters given by maps U Si, then ip 
has a meaning in the internal first-order logic of C and is classified by a subobject 
M ^ Of course, in general fipj may not be small. 

Now suppose that (p is a formula over U in S in the sense of ijTl Since each object- 
parameter of (/3 is a small map X ^ U , there is a regular epi U' ^ U over which 
X is a puUback of tt, and similarly for arrow-parameters. Since ip has only finitely 
many parameters, we can find a single cover U' U over which all parameters of 
if are represented by maps into Sq or 5*1 , and thereby translate if into a formula if 
at stage U' of the internal language of C about the internal category ^ 5*0 . 

However, without further axioms, there is little we can say about the relationship 
of f to if. Basically, the problem is that S only knows about the small objects over 
1, but if knows about small maps over all objects of C. So we need to assume that 
C is "generated by small objects" in a suitable sense. 

Definition 10.4. A category of classes C is well-generated by small objects 

if the following hold. 

(i) The small objects are a strong generator: if A >^ _B is a mononiorphism in 
C and every map U ^ B factors through A when U is small, then / is an 
isomorphism. 

P . 

(ii) The small objects are relatively projective: if U is small and A — » U is regular 

g 

epi, there is a small V and a regular epi V — » U which factors through p. 

(iii) The small objects are relatively indecomposable: if U is small and U — AU B, 
there are small objects V and W such that U = V U W, V A, and W C B. 

(iv) The small objects are collectively nonempty: if X is small and there is a map 
X ^ 0, then X = 0. 



Remark 10.5. Two of these conditions are well-known: (i) is called the axiom of 



small generators and (ii) is called the axiom of small covers (see [ABSS07b] V Note 



that (i) is always true if interpreted in the stack semantics, since all identities are 



small. By contrast, when (ii) is interpreted in the stack semantics of C, it becomes 



precisely the usual "collection axiom" of algebraic set theory (see [JM95J). 



Condition (iii) is rarely stated explicitly, since it follows from (ii) if all com- 



plemented monies are small, which in turn follows from the common assumption 



that all diagonals are small. And of course, (iv) is always true. However, we have 
chosen to state all four axioms explicitly in order to complete the analogy with 
(constructive) well-pointedness. 

Remark 10.6. If S is small in some external set theory, then C has a restricted 
Yoneda embedding C ^ Sh(S) into the category of sheaves for the coherent topol- 
ogy on S. In this case, C is well-generated by small objects if and only if this functor 
is coherent and conservative. This should be compared with [Remark 3.7l and like- 
wise the proof of lThcorem 10.81 should be compared with that of lTheorem 7.171 

[Remark 10.61 suggests that Sh(S) itself should be a "canonical" choice of a cat- 
egory of classes containing S, and in fact this is the case. 

Proposition 10.7. For any small Heyting pretopos S, the category Sh(S) of 
sheaves for the coherent topology on S is a category of classes in which S is a 
well- generating category of small objects. 
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Sketch of proof . The self-indexing of S is a stack for its coherent topology, so if 
we rectify it to a strict functor Cat, it will become an internal category 

in Sh(S) by the results of |Awo97[ §V.l]. With S the object of objects of this 
internal category and a suitable definition of E, this defines a representable notion 
of smallness. We then show that a map Y X is small iff for any J7 G S and 
any map y{U) — X, where y: S ^ Sh(S) is the Yoneda embedding, the pullback 
y{U) xx Y is representable. In particular, S is the category of small objects. It is 
then straightforward to verify the axioms. □ 

With this example in mind, the following theorem realizes our claim in the 
introduction that when S is small, the stack semantics of S can equivalently be 
defined as a fragment of the internal logic of Sh(S), which is "canonical" modulo 
the chosen strictification of the self-indexing. Recall the definition of a formula 
in the internal logic of C from any formula 1^9 in S in the language of a category. 

Theorem 10.8. Let C be a category of classes which is well-generated by small 
objects, and S the full subcategory of small objects. Then for any U G S, any 
formula (fi over U in S, and any p: V U in S, we have 

Vl^sif ^ V Ihc ^■ 
Here V' = V Xu U' , where U' ^ U is a cover chosen as in the definition of (p. 

Note that on the left, Ih refers to the stack semantics notion of forcing, while on 
the right it refers to the Kripke-Joyal semantics for the usual internal logic of C 
(which is, of course, the same as the Ap-fragment of the stack semantics of C, so 
there is no real ambiguity in the notation). 

Proof. The proof is by induction on if. The cases of atomic formulas, T, _L, and A 
are evident, so it remains to deal with V, 3, and V. We adopt the convention 
that adding a prime symbol denotes passing to a regular-epi cover over which all 
parameters are represented by morphisms to Sq or 5*1. 

Disjunction: if V Ihs V tp), then we have V = Wi U W2 in S with Wi Ihs 
and W2 Ihs V"- By the inductive hypothesis, W{ Ihc and W2 Ihc V"; thus V Ihc 

(^vv^) = (^vv5). 

Conversely, ifV Ihc (^V-^), then V = A[UA'2 with A[ Ihc and A'2 Ihc V'. Let 
Ai be the image of A[ in V, for i = 1,2, so that V = AiU A2. Since small objects 
are relatively indecomposable, we have V — W\ U W2 in S with W\ C A\ and 
W2 C A2. Therefore, W[ Ihc ^ and W2 Ihc and so by the inductive hypothesis, 
Wx Ihs (jC and W2 Ihs "0; hence V Ihs (<y3 V -0). 

Implication: suppose first V Ihs (}p V') and l^t — > V be a map in C 
such that A! Ihc Form the classifying subobject ^ A in C. Then for any 
W ^ A' where W £ S, wc have W Ihs tp) and W Ihc if, hence by the 

inductive hypothesis W Ihg if; thus W Ws ip and so (by the inductive hypothesis 
again) W Ihc V'- Therefore, W factors through f-ip}, and so W factors through 
IV']. Since the small objects are a strong generator, this implies |^] = A' , and thus 
A' Ihc -0; hence V Ihc (<^ =^ -0). 

Conversely, suppose V Ihc {<f V") and let W ^ V be such that W Ihs 
Then, by the inductive hypothesis, W Ihc ip, and so W' Ihc ■0, hence W Ihs ip. 
Thus, V Ihs {if ^ 
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Existential quantification: suppose first that V Ihs {3X)ip(X). Then we have 
W € S, a regular epi W ^ V, and an object Y e S/W such that W Ihs 
Passing to a cover W' -» W which represents Y (by a map y : W — Sq, say) as weh 
as all other parameters of ip, the inductive hypothesis implies that W I he ^(y)- 
Since W — J> V is regular epi, this implies V Ihc {3y)(p{y). 

Conversely, suppose V' Ihc {39)(f{9). Then we have a cover A' V' and a map 
y: j4' — J> with A' Ihc ^fiy)- Since small objects are relatively projective, there 
is a regular epi W -» V in S which factors through A' . Hence W Ihc ^fiy), so by 
the inductive hypothesis, W Ihs ^piY) where Y = y*E. Hence, V Ihs {3X)ip{X). 
Existential quantification over arrows is analogous. 

Universal quantification: suppose first that V' Ihc {yx)ip{x). Then for any 
W ^ V inS and Y € S/W, we can pass to a further cover W" -» W ^ W xy V 
over which Y is represented by some y: W Sq. Since W" Ihc {yy)(p{y), we 
have W" Ihc ^(y), and hence by the inductive hypothesis W Ihs ^{Y). Thus, 

i^ihs {yx)^{x). 

Conversely, suppose V Ihs (yX)Lp{X), let A' V' he a, map, take any y: A' ^ 
So, and form the classifying subobject ^ A'. Then for any map 

with in S, we have W Ihs {yX)(p{X), and thus, by the inductive hypothesis, 
W Ihc ^(j/)- Hence W factors through |<^(y)|, so since the small objects are a strong 
generator, we have = A', and so A' Ihc 'f{y)- Therefore, V Ihc (Va;)^(a;). 

Universal quantification over arrows is analogous. □ 

In particular, we have another way of producing autological (pre)topoi. 

Definition 10.9. A category of classes satisfies the separation Eixioni if every 
monomorphism is small. 

Corollary 10.10. If C is a category of classes which is well-generated by small 
objects and which satisfies the separation axiom, then its category S of small objects 
is autological. 

Proof BvlTh corcm 10. 8| any sentence (p over U G S induces a sentence in the 
internal logic of C at stage U' for some regular epi U' U. Since small objects 
are relatively projective, we may as well assume that C/' is small. By the separation 
axiom, it follows that the usual classifying object |^] in the internal logic of C is 
small, and so by closure under images, the image of the composite — >■ C/' — > t/ is 
a small subobject of U. The correspondence of [Theorem 10.81 then directly implies 
that this image classifies (p in the stack semantics of S, so S is autological. □ 

There remains the question of how a given category S can be embedded as the 
category of small objects in some category of classes C. We have seen that there 
is a "canonical" answer, namely Sii(S), but this category has some problems. In 
particular, it fails to satisfy some desirable axioms of algebraic set theory, such as 
that any quotient of a small object is small, or that all diagonals are small. We 
didn't need these axioms to prove IThcorcm 10. 8| but we will need some of them 
below to construct and compare models of material set theory. This problem can 
be solved by restricting to the subcategory of sheaves whose diagonals are small; 
these are the ideals of |AF06[ HFWOH] . 

Another problem, however, which afflicts both sheaves and ideals, is that not 
all axioms satisfied by S extend to corresponding properties of these categories of 
classes. Chief among the problematic axioms is separation; i.e. we have no converse 
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to ICoroUary lOlOl The proble m is that not all sheaves or ideals are "first-order 
definable" from S, so the first-order axiom schema of autology for S cannot be 
extended to the separation axiom for sheaves or ideals. 

One solution to this problem is proposed in (ABSSOTal lABSSOTb) : if S can be 
equipped with an extra non-elementary structure called a superdirected structural 
system of inclusions (sdssi), then it can be embedded in a category of superideals 
which does satisfy separation. (The word "structural" in the term sdssi is backwards 
from our usage — an sdssi is a very non- structural notion, in that it distinguishes 
between isomorphic objects.) This includes both complete toposes and realizability 
toposes, providing a unified reason why such toposes can model IZF. 

We prefer to view autology as the property characterizing those toposes which 
can model IZF, since unlike an sdssi, it is an elementary first-order property and can 
be phrased in a purely structural (i.e. category-theoretic) way. (By lCoroUary 10.10| 
any topos admitting an sdssi must be autological.) However, this would be most 
satisfying if any autological topos could be embedded in a category of classes sat- 
isfying the axiom of separation. One wants to consider the category of "first-order 
definable classes" over S, but it is nearly impossible to give this meaning in a purely 
structural way. However, we will show in [Shuaj that there is a canonical answer 
if we generalize to a 2- category of classes — namely, we can consider the 2-category 
of stacks for the coherent coverage on on S which are "definable" from the stack 
semantics in a precise sense. This modification is quite reasonable from the point 
of view of structural set theory, since there a "proper class" is something quite 
different from a set: at best it is a groupoid, having only a notion of isomorphism 
between its objects, rather than a notion of equality. 

We now turn to a comparison between models of material set theory in the 
stack semantics and in a category of classes. Since [Theorem 10.81 shows that the 
underlying logics agree, it remains to compare the "material sets" in the two models. 
This is quite similar to the situation in fj9] the main difference is that in a category 
of classes, the "material sets" are represented by morphisms into a single object Y 
(which is not, of course, small), rather than by morphisms into a family of objects 
making up a "pre-uni verse." 

(In fact, there is a formal relationship: a pre-universe in a topos S, in Hayashi's 
sense, naturally forms a single object of the category of ideals, in which we can apply 
the methods of this section. This is the jumping-off point of [ABSSOTal lABSSOTb) . 
which not only constructs a category of ideals, but a corresponding forcing semantics 
that generalizes Hayashi's.) 

As remarked above, in order to define the object 'f and perform this comparison, 
we need a little more structure on our category of classes. By an X -indexed family 
of small subobjects of A we mean a monic R A x X such that the projection 
i? — > AT is a small map. A powerclass object of A is an object PgA equipped 
with a universal PgA-indexed family of small subobjects of A. Note that in general, 
PgA need not be small even if ^ is. It is shown in |JM95j that powerclass objects 
can be constructed when C is exact. Authors who do not assume that C is exact 
often assume directly that powerclass objects exist. 

The following ad hoc definition summarizes what we need for our comparison. 

Definition 10.11. A category of classes C has a good material model if it 

satisfies the following. 
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(i) C has a small nno. 

(ii) If / and g are small, then so is Tifg. 

(iii) C has powerclass objects. 

(iv) If p is regular epi and fp is small, then / is small (equivalently, 1 I he 
y — 5- X is regular epi and Y is small, then X is smalP). 

(v) The endofunctor Pg has an indexed initial algebra 'f ^ i.e. a P^-algebra such 
that U*'f is an initial algebra for all f/ e C. 



if 



Assumptions (i) and (ii) ensure that S is a Il-pretopos with a nno, so that the 
theory of ij6] can be applied in its stack semantics. The other three axioms are 
about describing the universe-object 'f . Note that (iv) is necessary in order to 



make Ps into a covariant functor in the usual way. (In fact, Pg can be made into a 
monad, using (iv) again to obtain the multiplication — but we emphasize that the 



relevant notion of "algebra" refers only to an algebra for Pg as an endofunctor, 
not as a monad.) The indexed initial Ps-algebra Y is constructed in |JM95| under 
the assumption of exactness and a subobject classifier, and in |vdBM07] under the 
assumption of W-types and "bounded exactness;" we will simply assume it to exist. 

As for any initial algebra, the structure map Pg'f —> 1^ is an isomorphism. 
Thus, by the universal property of Pg, the inverse of v classifies a binary relation 
-< on Y which is "set-based," i.e. the second projection ^ Y \s small. It is 
not hard to show that -< is well-founded and extensional. An interpretation of 
material set theory in C is then obtained by considering Y with ^ as a model 
for material sets with G in the internal logic of C. It satisfies many of the axioms 
automatically, while others are inherited from the corresponding categorical axioms 
for C; see |JM95[ lMP02l IvdBMOTj for more details. 

Remark 10.12. There is a slightly different thread in algebraic set theory, starting 
with |Sim99j and continuing with [AF06| IAFW06j , in which material set theory is 
not modeled in the initial Pg-algebra but in an arbitrary object ^ equipped with 
a monomorphism Pg'W ^ ^ . The elements of ^ not in the image of Pg"^ are 
then regarded as "atoms," and the axiom of foundation is not necessarily satisfied. 
We will focus on the situation described above, which seems better suited to a 
comparison with the stack semantics. 

Now, from any morphism x: U ^ Y we can construct a well-founded extensional 
APG X over U as follows. First note that all our axioms are stable under puUback, 
so we may as well assume that U = 1. Now let i : Ps be the unique map 

such that 



1 



->iV 




PgY- 



^Pg 



commutes. Here rj: Y ^ PgY is the unit of the monad Pg, while c is the composite: 



^PgPg 



Pg 



(where /i is the multiplication of the monad Pg). Now x classifies an A''-indexed 
family of small subobjects of Y , i.e. a map x ^ N y. Y such that x ^ N \s small. 
Since N is also small, x is a small object. 
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Working in the internal logic of C, well-foundedness of Y now implies that the 
projection a; — > is monic. Since it is also a simulation, it follows that x is well- 
founded and extensional. It is rooted by x and accessible by definition, so it is a 
well-founded extensional APG, as desired. And just as in [J9j we can verify that 

(i) V W {x = y) if and only if a; = y, and 

(ii) J7 Ih (a; e y) if and only if a; ^ y. 

Thus it remains only to verify the analogue of lLemma 9.71 

Lemma 10.13. Let [/ G S, and let X be a well-founded extensional APG in S/U 
which remains well-founded in C/U. Then there exists a unique x:U ^ y such 
that X = x. 

Proof. This is essentially the standard recursion theorem for well-founded relations. 
Since Y is an indexed initial algebra, it suffices to assume that U = 1. Define an 
attempt to be a partial function X ^ Y which is a simulation and whose domain 
is a small initial segment of X. We can then use the internal logic of C to define 
"the set of all attempts" as a subobject of Ps{X x Y). Since X is well-founded, 
we can then prove by induction, as usual, that any two attempts agree on their 
common domain, that the union of attempts is an attempt, and that the union of 

all attempts has domain all of X. The resulting simulation X — > Y then exhibits 

X as isomorphic to x, where x is the composite 1 X -^-^ i^, and it is unique 
since Y is extensional. □ 

However, without further axioms, there is no reason why every well-founded 
extensional APG in S/U should also be well-founded in C/U. This will be true if 
C satisfies the axiom of separation, but in general there might be new subobjects 
of X in C/U that are not in S/U, so well-foundedness in C is a stronger statement 
than well-foundedness in S. If we do have this stronger property, though, then we 
can derive the desired equivalence. 

Theorem 10.14. Let C be a category of classes which is well-generated by small 
objects and has a good material model, with S its full subcategory of small objects, 
and assume that for all U G S, every well-founded extensional graph in S/U is 
also well-founded in C. Then the interpretation of material set theory in the stack 
semantics of S is identical to its interpretation relative to in the internal logic 
ofC. 

Proof. We have seen that under the given hypotheses, isomorphism classes of well- 
founded extensional APGs in S/U can be identified with maps U Y, in a 
way which preserves the atomic formulas. The same inductive argument from 
[Theorem 10.81 then implies that the interpretations agree on all formulas. □ 

Corollary 10.15. If C is a category of classes which is well-generated by small 
objects and has a good material model, and moreover satisfies the separation axiom, 
then the interpretation of material set theory in the stack semantics of its category 
of small objects is identical to its interpretation relative to Y in the internal logic 
ofC. □ 

Of course, asking that well-foundedness in S extends to C is a version of the 
axiom of "full well-founded induction" relative to the containing category of classes 
C. But even if S satisfies well-founded induction (in its stack semantics), this 
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property will generally fail to be inherited by categories of sheaves or ideals. This 
is the same problem we observed after [Corollary 10.10[ and it has the same solution. 
Namely, we will show in fShua' that the 2-category of definable stacks on S does 
inherit full well-founded induction from S, and that the stack semantics of S can 
be identified with the internal language of this 2-category. Thus, if we are willing 
to generalize from categories of classes to "2-categories of classes," stack semantics 
and algebraic set theory can be seen as two faces of the same coin. 

Appendix A. Material and structural foundations 

As mentioned in the introduction, we prefer to view the correspondence between 
set theories and (pre)toposes as a relationship between two different kinds of set 
theory, which we call material and structural. In material set theories such as ZFC, 
the elements of a set X have an independent reality and identity, apart from their 
being collected together as the elements of X; frequently they are also sets them- 
selves. The name "material" is a suggestion of Steve Awodey |Awo96] : they are also 
called "membership-based" set theories. By contrast, in structural set theories such 
as ETCS, the elements of a set X have no existence or identity independent of X, 
and in particular are not sets themselves; they are merely abstract "elements" with 
which we build mathematical structures. We call these theories "structural" be- 
cause they are closely aligned with the mathematical philosophy of "structuralism" 
(see e.g. jMcL93[ [Awo04j ) : they are also called "categorical" set theories. 

Remark A.l. In structural set theory, it is generally not meaningful to ask whether 
two elements of two different sets are equal, only whether two elements of a given 
ambient set are equal. In this way, structural set theory is very similar to type 
theory, and a case can be made that they are really different names for the same 
thing. There are undeniable differences in presentation and emphasis, but there is 
certainly a large space of theories which it is difficult to classify as one and not the 
other. In particular, as we remarked in footnote [5] on page 21 the stack semantics 
could equally well be phrased using a type theory with quantification over types. 

Material set theory, of course, has a long history as a foundation for mathe- 
matics, while structural set theory has not gained as broad a following, although 
Lawvere first wrote down the axioms of ETCS nearly 50 years ago. According to 
its proponents, structural set theory provides a foundation for mathematics which 
is just as adequate as the foundation provided by material set theory, and which is 
moreover closer to mathematical practice and free of superfiuous data. 

In support of this thesis, we observe that in most of mathematics, sets serve 
merely as carriers of structure: group structure, ring structure, topological struc- 
ture, etc. This view of mathematics was formally enshrined in Bourbaki's "general 
theory of structure" |Bou68j . Moreover, these structures, and hence the sets from 
which they are built, are generally only ever considered up to isomorphism. It never 
matters to the working mathematician whether the natural numbers are defined in 
von Neumann's way: 

= 0, 1 = {0}, 2 = {0,1}, 3 = {0,1,2}, ... 

or in some other way, such as: 

0-0, l-{0}, 2 = {1}, 3 = {2}, ... 
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since the two resulting versions of N are canonically isomorphic. In particular, the 
intricate global membership structure of material set theory is irrelevant outside 
of set theory proper. Indeed, Bourbaki had to carefully specify exactly how this 
superfluous data is to be forgotten, in order that all of their structures would be 
invariant under isomorphism. In structural set theory this process of careful for- 
getting is unnecessary, since there is no global G in the first place. (The complexity 
of the Cole-Mitchell-Osius construction summarized in [J6] testifies to the amount 
of data that must be forgotten.) 

From this point of view, the value of an equivalence between material and struc- 
tural set theory is that it implies that in principle, either could serve equally well 
as a foundation for mathematics. Of course, what really matters is the naturalness 
of the encoding — structural set theory would not be a very attractive foundation 
if mathematics could only be encoded in it by way of material set theory! How- 
ever, the observations above about mathematical structure provide good empirical 
evidence that in fact, the situation is reversed: material set theory provides a foun- 
dation for most mathematics only by way of structural set theory. 

On the other hand, the material point of view is not without advantages, espe- 
cially in set theory proper. Although the entire study of ZF could be reinterpreted 
structurally in terms of well-founded extensional relations, the result would be un- 
necessarily complicated. In particular, some of the powerful methods of material set 
theory seem difficult to duplicate structurally without significant circumlocution. 
This seems to be essentially the point expressed by Mathias [MatOlj : 

If one wants to do geometry, why bother with von Neumann or- 
dinals? What do they do that is not achieved by arbitrary well- 
orderings? Perhaps nothing. . . 

But if, sated with geometry, one wants to do transfinite recursion 
theory, why make life hard by avoiding von Neumann ordinals? 

Thus, we believe that there should be no real confiict between the two kinds of set 
theory. Rather, as frequently happens in mathematics, we simply have two different 
viewpoints on the same underlying reality. And as always in such a situation, 
recognition of this means that we can switch between the two theories freely, using 
whichever is most convenient for any purpose. From this perspective, our goal in 
this paper has been to extend the language and tools of structural set theory so 
as to deal with unbounded quantifiers directly, facilitating more direct comparisons 
with the corresponding language and tools of material set theory. The extension 
we have arrived at (the stack semantics) also of course has potential applications 
in topos theory by itself, which we hope to explore in later work. 
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